last executing test programs: 11m19.617301371s ago: executing program 4 (id=744): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmmsg$inet(r0, &(0x7f0000000900)=[{{&(0x7f0000007b00)={0x2, 0x4e21, @empty}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000180)="e6e0", 0x2}], 0x1}}, {{&(0x7f0000000140)={0x2, 0x4e20, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000007000000890704e0000002001100000000000000000000000100000001000000000000001c000000000000000000000008"], 0x50}}], 0x3ffffffffffff40, 0x800) sendto$packet(0xffffffffffffffff, &(0x7f0000000000)='1', 0x1, 0x0, 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0xc59b0e69fd196046, 0x0) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 11m19.32373135s ago: executing program 4 (id=746): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000040)={0x980903, 0x1}) r1 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$mice(0xffffff9c, &(0x7f000000c400), 0x105c40) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=@delchain={0x2c, 0x65, 0x400, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x3, 0xffff}, {0x10, 0xd}, {0xfff6, 0x1ffed}}, [@TCA_CHAIN={0x8, 0xb, 0x89}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8890}, 0x840) r6 = syz_open_dev$hidraw(0x0, 0x0, 0x60202) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000010b80)=[{{&(0x7f0000000380)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f0000000440)=[{&(0x7f0000000400)="ea374c1e37342a3144483fb0d7e33361f3d9660706553352cc9222b6b865e614abe9d09954686de1136b42200c937f87c9eebe1b9f32948bfd8fa0724f3b31df", 0x40}], 0x1, &(0x7f0000000580)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xffffffffffffffff}}}], 0x20, 0x40880}}, {{&(0x7f00000005c0)=@abs={0x0, 0x0, 0x4e20}, 0x6e, &(0x7f00000006c0)=[{&(0x7f0000000640)="c046dd8e6a5e27fb709e0155eeed8df398155f0d470dc4d4fbd139e7366a2cb3ecfca391dd965a4672470517b13a3a590dc67dbc93969adc77a02b29c6993ac4bf0120ce3127ffc0ec56d9b7f8f67ecadefd", 0x52}], 0x1, &(0x7f0000000700)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000200000000000000001000000010000006a47df691f22967271b6c98b4288f2f2cf1154916702e243e1b802be590f61f122fa06d765d52cb5fcc1beee1de15035c1100acd64ae2bb1915a7d098b991e5c8a4f74b9eb179293e81dea1dfb5e473317a18e4262a590d947306139a8db07593bfba2a58705c4ddc85e4e4e3c0dbff6738631c009901d48553876666944b4facd033ea08955106b52a38d2c63175ac4", @ANYRES32=r4, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000001000000", @ANYRES32=r1, @ANYRES32=r5, @ANYRES32=r0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000001000000", @ANYRES32=r4, @ANYRES32, @ANYRES32=r0, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRES32=r0], 0xf8, 0x4811}}, {{&(0x7f0000006200)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000006480)=[{&(0x7f0000006280)="21a3be", 0x3}, {&(0x7f00000062c0)="5aed7235b0d285e77ff98b7d2f4501b34480a6a3814f6f85142744e466d7959a3be49cf5847090787a695aec1c15d289980a327b4683fdd6602d268f08e7f6e4db30a0a5c69853ff9a328f6bb4a83a", 0x4f}, {&(0x7f0000006340)="0e77d7ca25c456200097c046a97469e077fa1c15454f0708bc94e0a78588a9768831c83ad6bdf8a136edc74461fa", 0x2e}, {&(0x7f0000006380)="0cee2f62d7a2c0178ac109f33c7af71b4d18f17ef9ef9499adda2f73bda62698156164044cdc6b79de45f51d15816be743122475152ceec3a844e3fbcae988e9505d871d7e207f46a0009d13c7ec3d2a3234ccf9bb891b2168bd0dd50705e491eca0d1e2ba6307dc3cb5405c503f41e258631a13dc246237043e435f93fed843ffeff9698e55e4b1edc6194a49f5496b0a4e46bf4a40862f9f28a85dd49a83cba16c0dc6f5bc19f12a328fd00b14e899382c6d607acc22c843f3729e7fcbcf71767948f4f5bd8bf5324f59cfbe927e4bf77798eccddfe254", 0xd8}], 0x4, &(0x7f0000008a40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000001000000", @ANYRES32=r3, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000028000000000000000100000001000000", @ANYRES32=r2, @ANYRES32=r3, @ANYRES32=r3, @ANYRES32, @ANYRES32=r6, @ANYRES32=r2, @ANYBLOB="1c000000000000000100000001000000", @ANYRES32, @ANYRES32=r0, @ANYRES32=r6, @ANYBLOB="000008ee23000000750c84f184ec380ba7fe9ffd", @ANYRES32, @ANYRES32=r2, @ANYRES32=r6, @ANYRES32, @ANYRES32, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32, @ANYRES32=r5, @ANYRES32=r0, @ANYRES32=r0], 0x130, 0xc800}}, {{&(0x7f0000008b80)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000008d00)=[{&(0x7f0000008c00)="7c1f6f66f7ebe5cfa902b6a2a7533eb8bd869a5f8cc7c06ff21811f5c0f56c05c34fe696b0b34019e421192a939747fbf88b5867b62ba9ac70f2b77202b9f84d991709afc198895122c12d4e1f18b0018fd0955ac546f0aafae52bafc477b1eb1d12bd7503931760f8f6e18334f9e6d5c86e51eb712b01ca5d2c51610b16562fd448ac0b3a43e4f7550a46ff6847747bd4fb71138758d6d824d18e456d543760c8aec6c2dcd0be3724920b9ede536322a024951c028f910aad1b6142d38229189c4fbc244dc60cbcdb62ba25a4c60f2b8170febb3e4f12b1eed6352f93ebf86ff3689c19e9a7d2", 0xe7}], 0x1, &(0x7f0000008f80)=[@rights={{0x1c, 0x1, 0x1, [r3, r4, r2]}}, @rights={{0x34, 0x1, 0x1, [r0, r2, r2, r5, r0, r6, r4, r4, r2]}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0xee00}}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xb8, 0x4000004}}, {{&(0x7f0000009040)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000009240)=[{&(0x7f00000090c0)="e91ab4dc9000d9f5a6c80210", 0xc}, {&(0x7f0000009100)="abc23c5d34f3f306bb235a87433f38665184a880f125e755b3cbad33e2b5cb4ec9189399aad01f8532e9ebe2b1c5c081834bcd1abdbedf9c4d6c7e97b51d3a29d75cd83316556d0f9c2cd3567f455c0fcdd70557bceef184e52a831b2a2df5c1f78f7d81c2ad19", 0x67}, {&(0x7f0000009180)="44f21bc609271e31b085267e47e72757fd043a15530dc3825fca71128b46a9cd5eb0a156c8484cf52c9b72ecad0f152a3d9d099da9e7a9718f5f3b10ae5e0634d2d9e4b9a0688f54380087aa19a6b8e42df3256e1d1c9b3b74b1797f87b0bab124494de477541464cc5e70abd6a0d11a01675fe0d3c40ebe83987b23b6b35646f7", 0x81}], 0x3, &(0x7f000000ab00)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [r6, r1, r5, r4, r3, r5, r4]}}, @cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [r1, 0xffffffffffffffff, r0, r2, r2, r6, r1, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [r4, r6, r3, r6]}}, @rights={{0x14, 0x1, 0x1, [r0]}}, @cred={{0x1c}}], 0x140}}, {{0x0, 0x0, &(0x7f000000af80)=[{&(0x7f000000ac40)="2d76fe40827b145cc795a61d083da88b8db741485c04e1cc2fc85b375ad230a674c2b862449deab5b03da0aebc3d2cdc108a803b4ff671b06ee01a6edb5d6c76d3e82f47eb72c953e18e250715", 0x4d}, {&(0x7f000000acc0)="a74e3ce4788b07e985", 0x9}, {&(0x7f000000ad00)="3c4e8201b9141fd20888d925eede40558bba54612791ee66ac8c612df505fee3184624c7915a8cd0ff41582a8ecc3f5192b750ae9e48c44c112a99a546e395db833e154661132ca2c9663f5602b502bd33f3f31ab16fc57a1670f99469658fec86a49718aaf1c3a3b909e07b34b5dbb0710009973370cae20ffb20db740007a139ae", 0x82}, {&(0x7f000000adc0)="6cbcccbbf7d77cce346534cca1ebeed353b48bbdf6eaa8f06dea3ad6be65d810bba5cc988036e65fb1484820b1cbaa01461fc773fd02fdb1471c93d6a58164d0c8d014819bf370789a6d1e7b49ef2e22d6cd4ed5578ce427d7a34a467e46846e5c7bed75f6ba8ffd7d2b5ec8137f0a86bfd00979d4ba524c1e218b6a47e4d80dc5d976648ce8", 0x86}, {&(0x7f000000ae80)="27790038632e3e610301f5de79dc7a75166425f35d311395a8a869da404e283fd44fe86e92dcd4bfb15defdcd080d0d52545558d24d05a4d48", 0x39}, {&(0x7f000000aec0)="1bdc700baa36ee9439bee28f7fd2eda1d730fa8fa3230a6099131460e3b5aaf18b315741bfa282be63b94a85424fd3bbef89699a4e4de12943bab6b01fe8d9d2a792159e1d971f65740b235205811faa2be52c46b9394f", 0x57}, {&(0x7f000000af40)="43b61a38f78a2771f82be2b7393332d6581fc5103cf5606b", 0x18}], 0x7, &(0x7f000000b1c0)=[@cred={{0x1c}}, @rights={{0x38, 0x1, 0x1, [r4, r1, r0, r0, 0xffffffffffffffff, r0, r1, r4, r6, r3]}}, @rights={{0x1c, 0x1, 0x1, [r1, r6, r3]}}, @rights={{0x10}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r2]}}], 0xa8, 0x44000}}, {{&(0x7f000000b280)=@abs={0x1, 0x0, 0x4e22}, 0x6e, &(0x7f000000b300), 0x0, &(0x7f000000e500)=[@rights={{0x14, 0x1, 0x1, [r2]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [r2, r6, 0xffffffffffffffff, r4]}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xee01}}}, @rights={{0x18, 0x1, 0x1, [r0, r3]}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff}}}], 0xd0, 0x81}}, {{&(0x7f000000e600)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f000000e980)=[{&(0x7f000000e680)="86454af5156bd0357abea411488969865e7c7fa022f89986b85dd7a0d656cef1296bc6995da1c5fbabea2e0d65d4c96b1bf8c7f496982694d0ae11da0f3cca205f0830609c817c4268af60e4be7048373fc706029fb8ae1127b90e9897e8e689bbfce8bbbec3dc65f5debb422b4e68e0144b79dbf18e9ea88ece96c88fb0fe07a5da1573c346711066d002a88a776f91778bd3d7ee8c7bc3fe5ada0f611904177fb974fb96a6a770c1677c79054d110d2b09ce9e3f33", 0xb6}, {&(0x7f000000e740)="e80279ee1d1a30be3ae03fc1d256a3a8eb2f4599e438cc1d2237588c2753345f3a38e3e8bb0ce4f1a90089374e849647dbe6c43382e8b9de28e7e21eb5d567d97cfc90e0fda94e2b2150240f0366e93923ee6c8b1c0b24f193c1e78cd76325729ba275892af003e994142a886101118b51ae39ff20fa4a4f6ac01940cd0802494ae9950b2359597895f5c29438437ec94f9827bb413443c74ea88ee10b25dcce27f2d3ea8feaeb6d078742cea6732934a295e288a11a8befdce236f0e1e1cbe37211a92da81b12be472d8c3b87f86870d697592b1df0384f100d4bcdc45db2100e2702adbb6c800653ca75674e76e676ef2fd3e0c8dc741edc71", 0xfa}, {&(0x7f000000e840)="02e460f352d4debf3e9f5b865dbb484356378fae54c33aa67888b844768bc4e5da27ecc374427eb0965544d6281789dd76fc85914699ed96f96d428630004a1426749c35575770ff01167888cc1483ab386eae4dacc0b8c6ec42b38a9587d2269dc9fa6a7f411f0169e0519142b819e912c008809d041377172eb0a5fc7b020223cc9a4311271ace368567a0d279b1166248b2f5d105e4eafea9192a1cc89d67e52df59667a9ed6df7bb881244befab140a09a73393a5d53164968eca7a93a682d2c870c426c39569344f7b57640d8b6dd8db6117f767ef714370a853bc425621bc81782b1a696f53d50407f71a9cc4a07c56271f3e672f5f2", 0xf9}, {&(0x7f000000e940)="566a2e16609ea08587c6bcc7", 0xc}], 0x4, &(0x7f0000010ac0)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [r6, r0, 0xffffffffffffffff, r1, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [r6, r1]}}, @rights={{0x18, 0x1, 0x1, [r0, r4]}}, @cred={{0x1c}}], 0xb8, 0xbaf618defa4345ac}}], 0x8, 0x4000800) r7 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r7, 0xaf01, 0x0) ioctl$VHOST_SET_LOG_FD(r7, 0x4004af07, &(0x7f0000000340)) ioctl$VHOST_SET_VRING_KICK(r7, 0x4008af20, &(0x7f0000000040)={0x2}) ioctl$VHOST_SET_VRING_ADDR(r7, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r7, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/74}) ioctl$VHOST_SET_MEM_TABLE(r7, 0x4008af03, &(0x7f0000000240)) ioctl$VHOST_VSOCK_SET_RUNNING(r7, 0x4004af61, &(0x7f0000000000)=0x1) r8 = syz_open_dev$sg(&(0x7f0000001940), 0x0, 0x202) ioctl$SCSI_IOCTL_PROBE_HOST(r8, 0x5385, &(0x7f0000000000)={0x8d, ""/141}) bpf$MAP_CREATE(0x0, 0x0, 0x50) sched_setaffinity(0x0, 0x8, &(0x7f0000019400)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r9 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00', 0x0}) setsockopt$inet6_mreq(r9, 0x29, 0x1b, &(0x7f0000000000)={@dev={0xfe, 0x80, '\x00', 0xd}, r10}, 0x14) sendmmsg$inet6(r9, &(0x7f0000000500)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x1, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="24000000000000002900000032000000fe8000000000000000000000000000bb", @ANYRES32=r10, @ANYBLOB="0600dad624c8fe7e0000bb164d100900000003"], 0x28}}], 0x1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'wlan0\x00'}) 11m18.904227964s ago: executing program 4 (id=751): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a32000000001400000011"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x37, [0x8, 0x1, 0x5, 0x9, 0x10008, 0x155f, 0x6, 0x4, 0x25cd, 0x1, 0xb4, 0xa, 0xa2b9, 0x8, 0x7, 0xe4, 0x7, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x1, 0x8, 0xd, 0x4, 0x12a3, 0x6, 0xffffffff, 0x2, 0x6, 0x7, 0x81, 0x9, 0x79, 0x25713dc3, 0x10000, 0x0, 0x95, 0x4, 0x4, 0x16, 0x2, 0x5, 0x401, 0xfffffff5, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x3, 0x1000, 0xef1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0xc66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x81, 0x2, 0x809, 0x4, 0xa7, 0x1400, 0x0, 0x200a398, 0x400000, 0x7, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x400, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffffff8, 0x401, 0x7, 0xf1, 0x4, 0x1, 0xffff, 0x6, 0x2, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x1, 0x80000004, 0x6, 0x438, 0x2, 0xfffffffd, 0x95, 0x7fffffff, 0x4, 0xfffffff9, 0x1, 0x1000, 0xfffff801, 0x5], [0xfffffffe, 0xfffffffe, 0xffff, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x8d3, 0x200006, 0x8, 0x400, 0x41, 0x400, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x3, 0x5, 0x9, 0x3, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x8000, 0x400, 0x3e55, 0x5, 0xd3, 0x408, 0x3437, 0x3, 0xd, 0x7, 0x601, 0x101, 0xdd80, 0x60a0, 0x7f, 0x9d26, 0x10000, 0x1, 0x2, 0x2, 0x6, 0x8000, 0x4, 0x3, 0x29a8, 0x8, 0x77, 0x7, 0x6, 0x10000, 0xfffffffd, 0x8, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0x40bfc, 0x8, 0x5, 0x7f, 0x2a29, 0x40, 0xff, 0x1005, 0x1, 0x7, 0x1e, 0x9, 0x81, 0x1, 0x19d86, 0xd, 0xfffffff7, 0x8, 0x6, 0x5396, 0x3, 0x200006, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x8, 0x7fffffff, 0x9, 0xc, 0x132d, 0xeb, 0x201, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8008, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x5337, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x3, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x40000000000180, 0x2, 0x2, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x0, 0x5, 0x4, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, &(0x7f0000000340)={'gre0\x00', &(0x7f0000000200)=@ethtool_ringparam={0x10, 0x80000001, 0x3, 0x1, 0xd, 0xefe, 0x0, 0x0, 0x8}}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r6 = io_uring_setup(0x115c, &(0x7f0000000440)={0x0, 0x8270, 0x40, 0x3, 0x117}) io_uring_register$IORING_REGISTER_BUFFERS(r6, 0x0, &(0x7f0000000640)=[{0x0}], 0x178) 11m16.695279039s ago: executing program 4 (id=756): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x1) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) 11m15.605871434s ago: executing program 4 (id=759): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000000)=ANY=[@ANYBLOB="c296aa5df0cdb8d056537befbb26260c1c000000", @ANYRES16=r1, @ANYBLOB="030f0000000000000000340000000800030002000000"], 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c00000025000103020000200000000001000000080003"], 0x1c}, 0x1, 0x0, 0x0, 0x20000018}, 0x4004000) socket$caif_stream(0x25, 0x1, 0x1) recvmmsg(r2, &(0x7f0000001a40)=[{{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000180)=""/80, 0xfc9b}], 0x1, &(0x7f0000000a40)=""/4096, 0x1000}}], 0x2, 0x40020143, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_group_source_req(r3, 0x0, 0x2e, &(0x7f0000000000)={0x8, {{0x2, 0x4e21, @multicast1}}, {{0x2, 0x4e23, @private=0xa010100}}}, 0x108) setsockopt$inet_group_source_req(r3, 0x0, 0x2e, &(0x7f0000000140)={0x5, {{0x2, 0x4e21, @multicast1}}, {{0x2, 0x6e1d, @multicast1}}}, 0x108) setsockopt$inet_group_source_req(r3, 0x0, 0x2c, &(0x7f0000000280)={0x8, {{0x2, 0x4e23, @multicast1}}, {{0x2, 0x4e24, @loopback}}}, 0x108) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = syz_open_dev$vcsn(&(0x7f00000000c0), 0xf679, 0xcc3) fsconfig$FSCONFIG_SET_FD(r5, 0x5, &(0x7f0000000040)=')/+]}%[\\*[+-.\x00', 0x0, r4) sendmsg$IPCTNL_MSG_CT_DELETE(r4, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={0x0, 0x38}, 0x1, 0x0, 0x0, 0x10050}, 0x4) 11m12.399889018s ago: executing program 4 (id=768): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000000)=0x10000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000100)={@local}) ioctl$IOCTL_VMCI_CTX_REMOVE_NOTIFICATION(r0, 0x7b0, &(0x7f0000000140)={@host}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000007500)=ANY=[@ANYBLOB="300000003e0007012bbd700000000000017c00000400fc800e0001806d1431496535e8ff00000000080002"], 0x30}, 0x1, 0x0, 0x0, 0xc000}, 0xc040) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@bridge_getneigh={0x4c, 0x1e, 0x1, 0x70bd26, 0x25dfdbfe, {0x7, 0x0, 0x0, 0x0, 0x40000, 0x2000a}, [@IFLA_NET_NS_FD={0x8}, @IFLA_MAP={0x24, 0xe, {0xffffffffffffffff, 0x800, 0x0, 0x6, 0x3, 0x5}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24040800}, 0x0) unshare(0x2040600) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000140)={r4, 0x0, 0x0}, 0x1c) r5 = syz_usb_connect(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="31010000dccd5e08cb060700000800000001090224000100007e000904340102d469e7000905", @ANYRES32], 0x0) syz_usb_control_io$uac1(r5, 0x0, 0x0) syz_open_dev$evdev(0x0, 0xe, 0x2000) connect$can_bcm(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r1, 0x8983, &(0x7f0000000080)={0x1, 'macvlan0\x00', {}, 0x5}) io_setup(0xfff, &(0x7f00000000c0)=0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c8) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './file2'}}, {@index_on}], [], 0x2c}) r7 = eventfd2(0x29c, 0x0) r8 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000a80)={0x0, &(0x7f0000000c80)=[@nested_create_vm={0x12d, 0x18, 0x2}, @nested_create_vm={0x12d, 0x18}, @wrmsr={0x65, 0x20, {0xa6f, 0x3}}, @nested_load_syzos={0x136, 0x148, {0x3, 0x9, [@wr_drn={0x68, 0x20, {0xa, 0x2}}, @nested_amd_vmsave={0x183, 0x18, 0x3}, @enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @cpuid={0x64, 0x18, {0x1ff}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @ro_nat=0x6400, 0x4, 0x6, 0xffffffffffffffff}}, @nested_amd_vmload={0x182, 0x18, 0x1}, @set_irq_handler={0xc8, 0x20, {0x8e, 0x1}}, @nested_amd_inject_event={0x180, 0x38, {0x2, 0xef, 0x4, 0x8864, 0x3}}]}}, @nested_vmlaunch={0x12f, 0x18, 0x2}, @nested_amd_vmload={0x182, 0x18, 0x3}, @nested_amd_clgi={0x17f, 0x10}, @nested_amd_stgi={0x17e, 0x10}, @nested_amd_stgi={0x17e, 0x10}, @in_dx={0x69, 0x20, {0x8480}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x3, @control_nat=0x6000, 0x8, 0x0, 0xfff}}, @cpuid={0x64, 0x18, {0xd, 0x1000}}, @wrmsr={0x65, 0x20, {0x9a6, 0x8}}, @nested_load_syzos={0x136, 0xa8, {0x0, 0x4708, [@cpuid={0x64, 0x18, {0x7, 0x3}}, @wr_crn={0x67, 0x20, {0x8, 0x7}}, @nested_load_syzos={0x136, 0x20, {0xfffffffffffffffd, 0xbc4}}, @nested_amd_set_intercept={0x181, 0x30, {0x0, 0x4, 0x5}}]}}, @nested_load_syzos={0x136, 0x38, {0x1, 0x100000000, [@nested_vmlaunch={0x12f, 0x18, 0x1}]}}, @nested_amd_vmload={0x182, 0x18, 0x3}, @uexit={0x0, 0x18, 0x7}, @wr_drn={0x68, 0x20, {0x3, 0x2}}, @in_dx={0x69, 0x20, {0x93d5, 0x5}}], 0x3d8}) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f0000000b40)={0x8, 0x3, "6af2ce93b260f3c6aad3535ec671a10e4ee29d1dfa5d97950b71c80d438b73bb1bf3d01776c0d9d4eea01814c12cb71e5cd652559a8424396a897ff2dcd15f73f29e3a5241f49ebe4e51dbefbeead9bc29878f5c860c355e0130dfe5a384feae731ee111ed37379224a3e3feae16116d8e40b26fb43e995a18262cd79af45973f9445d0dfaf8ff093463f202b6466dd704530dda952b966020b6f2cc375d7347f3b86d6ac8da6b781fb48219c22c571f473734a01dd7898be9fc7db606da88e7d037bd457b21d481732087784b3384bd8c149607975913d86b55a8b768c1d2d35737b7bfff77e70ce1b5a04c551e8b112d5aa23794112ac5aefc68b364eaeb06"}) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r8, 0x4068aea3, &(0x7f0000000ac0)) r9 = eventfd(0xacce) r10 = eventfd2(0x709, 0x0) io_submit(r6, 0x4, &(0x7f0000000640)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x8, 0x9, r2, &(0x7f0000000140)="4317381d80fa5253bf82823d91147bc979af6645", 0x14, 0xf, 0x0, 0x2, r7}, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2, 0xf32d, r1, &(0x7f0000000240)="0c56f83ee92706d5365babbcf180a0ba88faef50c6d23383436116b5ddb7bc75b718eea83c99c40a427ea33f5bab2eb0dc7c976a8bc773e562117dacd17c6d21342216c36a9902d146ff4346e3a75f084a5630c9b005f01f22f296f44aa57037a7", 0x61, 0x5, 0x0, 0x3, r9}, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x2, 0xd, r2, &(0x7f0000000440)="8895c8ef268b33ae42e6ec596dfc31ad1fad74e02b28c35b6950a327861df9caa9432acb2805ca0a8327ba0116320f1ad5d279c991d9fa6798db77d037608b1ecef3185e1a1bf07a310791e049ed7eb11220d55a61555cfcc50592eaa40a50a19c2c3efe423dba562f8b90f4c3f9668263866eea1225783937d090ac21f97459dafeab139723ea681f6f6bd1f82827fba78d5e567bbaeb9891ebc317bffc3833e27b70d7dbe3b5588ff89c8efedd29015bf819f40ba30309dd2c0a4f", 0xbc, 0x81, 0x0, 0x3}, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x7, 0x1, 0xffffffffffffffff, &(0x7f0000000540)="907669b1d1b0e6e4d5e5ab807946ce19bf9de8bff4b6cfdaf7682b850ede233e1c3815d908371c48d767916632d9eecaab699ab797df0e6bcd82c9878c5aab108d4639eed45bbc8038bcdba9f17ef091c943370d1890a4e630ae5d0d323cc7d33696bc4217aba07fbb94e28f5d89794660cff0963cbb56675cc5b505355c932ba62db7de1b7c5b1d69e380d8f8faf1943f2134623e5dd0bf02e3e6dddc3b52415a75d8d62adde4b3457ba31477013864c2", 0xb1, 0xd0c3, 0x0, 0x1, r10}]) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="05"], 0x48}, 0x1, 0x0, 0x0, 0x48850}, 0x200008c1) 11m11.950304008s ago: executing program 32 (id=768): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000000)=0x10000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000100)={@local}) ioctl$IOCTL_VMCI_CTX_REMOVE_NOTIFICATION(r0, 0x7b0, &(0x7f0000000140)={@host}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000007500)=ANY=[@ANYBLOB="300000003e0007012bbd700000000000017c00000400fc800e0001806d1431496535e8ff00000000080002"], 0x30}, 0x1, 0x0, 0x0, 0xc000}, 0xc040) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@bridge_getneigh={0x4c, 0x1e, 0x1, 0x70bd26, 0x25dfdbfe, {0x7, 0x0, 0x0, 0x0, 0x40000, 0x2000a}, [@IFLA_NET_NS_FD={0x8}, @IFLA_MAP={0x24, 0xe, {0xffffffffffffffff, 0x800, 0x0, 0x6, 0x3, 0x5}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24040800}, 0x0) unshare(0x2040600) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000140)={r4, 0x0, 0x0}, 0x1c) r5 = syz_usb_connect(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="31010000dccd5e08cb060700000800000001090224000100007e000904340102d469e7000905", @ANYRES32], 0x0) syz_usb_control_io$uac1(r5, 0x0, 0x0) syz_open_dev$evdev(0x0, 0xe, 0x2000) connect$can_bcm(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r1, 0x8983, &(0x7f0000000080)={0x1, 'macvlan0\x00', {}, 0x5}) io_setup(0xfff, &(0x7f00000000c0)=0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c8) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './file2'}}, {@index_on}], [], 0x2c}) r7 = eventfd2(0x29c, 0x0) r8 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000a80)={0x0, &(0x7f0000000c80)=[@nested_create_vm={0x12d, 0x18, 0x2}, @nested_create_vm={0x12d, 0x18}, @wrmsr={0x65, 0x20, {0xa6f, 0x3}}, @nested_load_syzos={0x136, 0x148, {0x3, 0x9, [@wr_drn={0x68, 0x20, {0xa, 0x2}}, @nested_amd_vmsave={0x183, 0x18, 0x3}, @enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @cpuid={0x64, 0x18, {0x1ff}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @ro_nat=0x6400, 0x4, 0x6, 0xffffffffffffffff}}, @nested_amd_vmload={0x182, 0x18, 0x1}, @set_irq_handler={0xc8, 0x20, {0x8e, 0x1}}, @nested_amd_inject_event={0x180, 0x38, {0x2, 0xef, 0x4, 0x8864, 0x3}}]}}, @nested_vmlaunch={0x12f, 0x18, 0x2}, @nested_amd_vmload={0x182, 0x18, 0x3}, @nested_amd_clgi={0x17f, 0x10}, @nested_amd_stgi={0x17e, 0x10}, @nested_amd_stgi={0x17e, 0x10}, @in_dx={0x69, 0x20, {0x8480}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x3, @control_nat=0x6000, 0x8, 0x0, 0xfff}}, @cpuid={0x64, 0x18, {0xd, 0x1000}}, @wrmsr={0x65, 0x20, {0x9a6, 0x8}}, @nested_load_syzos={0x136, 0xa8, {0x0, 0x4708, [@cpuid={0x64, 0x18, {0x7, 0x3}}, @wr_crn={0x67, 0x20, {0x8, 0x7}}, @nested_load_syzos={0x136, 0x20, {0xfffffffffffffffd, 0xbc4}}, @nested_amd_set_intercept={0x181, 0x30, {0x0, 0x4, 0x5}}]}}, @nested_load_syzos={0x136, 0x38, {0x1, 0x100000000, [@nested_vmlaunch={0x12f, 0x18, 0x1}]}}, @nested_amd_vmload={0x182, 0x18, 0x3}, @uexit={0x0, 0x18, 0x7}, @wr_drn={0x68, 0x20, {0x3, 0x2}}, @in_dx={0x69, 0x20, {0x93d5, 0x5}}], 0x3d8}) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f0000000b40)={0x8, 0x3, "6af2ce93b260f3c6aad3535ec671a10e4ee29d1dfa5d97950b71c80d438b73bb1bf3d01776c0d9d4eea01814c12cb71e5cd652559a8424396a897ff2dcd15f73f29e3a5241f49ebe4e51dbefbeead9bc29878f5c860c355e0130dfe5a384feae731ee111ed37379224a3e3feae16116d8e40b26fb43e995a18262cd79af45973f9445d0dfaf8ff093463f202b6466dd704530dda952b966020b6f2cc375d7347f3b86d6ac8da6b781fb48219c22c571f473734a01dd7898be9fc7db606da88e7d037bd457b21d481732087784b3384bd8c149607975913d86b55a8b768c1d2d35737b7bfff77e70ce1b5a04c551e8b112d5aa23794112ac5aefc68b364eaeb06"}) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r8, 0x4068aea3, &(0x7f0000000ac0)) r9 = eventfd(0xacce) r10 = eventfd2(0x709, 0x0) io_submit(r6, 0x4, &(0x7f0000000640)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x8, 0x9, r2, &(0x7f0000000140)="4317381d80fa5253bf82823d91147bc979af6645", 0x14, 0xf, 0x0, 0x2, r7}, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2, 0xf32d, r1, &(0x7f0000000240)="0c56f83ee92706d5365babbcf180a0ba88faef50c6d23383436116b5ddb7bc75b718eea83c99c40a427ea33f5bab2eb0dc7c976a8bc773e562117dacd17c6d21342216c36a9902d146ff4346e3a75f084a5630c9b005f01f22f296f44aa57037a7", 0x61, 0x5, 0x0, 0x3, r9}, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x2, 0xd, r2, &(0x7f0000000440)="8895c8ef268b33ae42e6ec596dfc31ad1fad74e02b28c35b6950a327861df9caa9432acb2805ca0a8327ba0116320f1ad5d279c991d9fa6798db77d037608b1ecef3185e1a1bf07a310791e049ed7eb11220d55a61555cfcc50592eaa40a50a19c2c3efe423dba562f8b90f4c3f9668263866eea1225783937d090ac21f97459dafeab139723ea681f6f6bd1f82827fba78d5e567bbaeb9891ebc317bffc3833e27b70d7dbe3b5588ff89c8efedd29015bf819f40ba30309dd2c0a4f", 0xbc, 0x81, 0x0, 0x3}, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x7, 0x1, 0xffffffffffffffff, &(0x7f0000000540)="907669b1d1b0e6e4d5e5ab807946ce19bf9de8bff4b6cfdaf7682b850ede233e1c3815d908371c48d767916632d9eecaab699ab797df0e6bcd82c9878c5aab108d4639eed45bbc8038bcdba9f17ef091c943370d1890a4e630ae5d0d323cc7d33696bc4217aba07fbb94e28f5d89794660cff0963cbb56675cc5b505355c932ba62db7de1b7c5b1d69e380d8f8faf1943f2134623e5dd0bf02e3e6dddc3b52415a75d8d62adde4b3457ba31477013864c2", 0xb1, 0xd0c3, 0x0, 0x1, r10}]) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="05"], 0x48}, 0x1, 0x0, 0x0, 0x48850}, 0x200008c1) 2m33.947085385s ago: executing program 0 (id=3071): capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000080)={0x6, 0xe, 0x13e, 0x89, 0xffffffff, 0x2}) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) read$dsp(r0, 0x0, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000003, 0xc3072, 0xffffffffffffffff, 0x0) syz_clone(0x80842111, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='pagemap\x00') pread64(r1, &(0x7f0000001240)=""/102400, 0x19000, 0x1000000300) 2m33.71703409s ago: executing program 0 (id=3073): r0 = socket(0x2, 0x80805, 0x0) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000240)={0x84, @rand_addr=0x64010102, 0x4e20, 0x3, 'wlc\x00', 0x0, 0xa7e, 0x70}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010101, 0x4f29, 0x3, 'wlc\x00', 0x5, 0xc, 0x6c}, {@multicast1, 0x4e23, 0x3, 0xcd, 0x1}}, 0x44) openat$random(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040), 0xc4002, 0x0) r2 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) unshare(0x400) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$XFS_IOC_FD_TO_HANDLE(r1, 0xc038586a, &(0x7f0000000400)={r2, &(0x7f0000000280)='wlc\x00', 0x50040, &(0x7f00000002c0)={@_ha_fsid={[0x9, 0x6]}, {0xb2, 0x3}}, 0x6, &(0x7f0000000300)={@_ha_fsid}, &(0x7f0000000340)=0x8}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0xf0) ioctl$KVM_CAP_X86_GUEST_MODE(r3, 0x4068aea3, &(0x7f00000001c0)) 2m33.487872736s ago: executing program 0 (id=3074): unshare(0x22020600) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x103a42, 0x0) ftruncate(r2, 0x6000000) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r2, 0x4000) mknodat$loop(0xffffffffffffff9c, 0x0, 0x1000, 0x1) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) r3 = openat$dir(0xffffffffffffff9c, 0x0, 0x40400, 0x8) fcntl$notify(r3, 0x402, 0x8000003b) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0x334ecc4b, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) 2m30.200613285s ago: executing program 0 (id=3081): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0xf0) pwritev2(r0, &(0x7f0000000100), 0x0, 0x200, 0x1000, 0x13) 2m30.059863519s ago: executing program 0 (id=3082): r0 = creat(&(0x7f0000000140)='./file0\x00', 0xdafbe5d6891b6e4) r1 = inotify_init1(0x0) r2 = inotify_add_watch(r1, &(0x7f0000000440)='.\x00', 0x20000000) write$binfmt_elf32(r0, &(0x7f0000005640)=ANY=[@ANYRES16=r2], 0x69) close(r0) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000380)=@newlink={0x3c, 0x10, 0x1, 0x170bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2100}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x14, 0x1a, 0x0, 0x1, [@AF_INET={0x8, 0x2, 0x0, 0x1, {0x4}}, @AF_INET={0x8, 0x2, 0x0, 0x1, {0x4}}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc0}, 0x10) 2m29.397414169s ago: executing program 0 (id=3087): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500"], 0x0, 0x9, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x38, &(0x7f0000000280)=[@in6={0xa, 0x4e21, 0x7ff, @mcast1, 0xeb2}, @in6={0xa, 0x4e21, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x1c8e}]}, &(0x7f0000000180)=0xfffffffffffffe6d) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, &(0x7f0000000080)=[{&(0x7f0000000340)="480000001400190d09034beafd0d36020a841a000000230f00000000a2bc5603ca00000f7f89004e00200000000101ff00c00e03000200000000000000000300005839c900910000", 0x48}], 0x1) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r3, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r3, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) socket$phonet_pipe(0x23, 0x5, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05000000050000000200000047"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xa, 0x3, 0x4, 0x8}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f00000009c0)=ANY=[@ANYBLOB="1800000003000000000000000040000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000700000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r5, r4}, 0xc) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000002700)=""/102392, 0x18ff8) getpgid(0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x10, 0xffffffff) mount(&(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='jfs\x00', 0x1a0c000, 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000500)=ANY=[@ANYBLOB="0180c20000020180c20000000800450000600000000001019078ac1e0001ac1414aa050090bc4681819513d8a3d0fb6fe0a759d6688332ba41e5f2b778000000110000ac1414aaac1414aa00442c00030a01010100000000e000000200000000000000000000000c00000000000000000000884d0000fffffffc00"], 0x0) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) r8 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) write$sequencer(r8, &(0x7f00000000c0)=ANY=[@ANYBLOB="920ad002ff3340009401effa50e60000"], 0x10) close_range(r7, 0xffffffffffffffff, 0x200000000000000) 2m14.186097986s ago: executing program 33 (id=3087): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500"], 0x0, 0x9, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x38, &(0x7f0000000280)=[@in6={0xa, 0x4e21, 0x7ff, @mcast1, 0xeb2}, @in6={0xa, 0x4e21, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x1c8e}]}, &(0x7f0000000180)=0xfffffffffffffe6d) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, &(0x7f0000000080)=[{&(0x7f0000000340)="480000001400190d09034beafd0d36020a841a000000230f00000000a2bc5603ca00000f7f89004e00200000000101ff00c00e03000200000000000000000300005839c900910000", 0x48}], 0x1) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r3, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r3, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) socket$phonet_pipe(0x23, 0x5, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05000000050000000200000047"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xa, 0x3, 0x4, 0x8}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f00000009c0)=ANY=[@ANYBLOB="1800000003000000000000000040000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000700000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r5, r4}, 0xc) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000002700)=""/102392, 0x18ff8) getpgid(0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x10, 0xffffffff) mount(&(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='jfs\x00', 0x1a0c000, 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000500)=ANY=[@ANYBLOB="0180c20000020180c20000000800450000600000000001019078ac1e0001ac1414aa050090bc4681819513d8a3d0fb6fe0a759d6688332ba41e5f2b778000000110000ac1414aaac1414aa00442c00030a01010100000000e000000200000000000000000000000c00000000000000000000884d0000fffffffc00"], 0x0) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) r8 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) write$sequencer(r8, &(0x7f00000000c0)=ANY=[@ANYBLOB="920ad002ff3340009401effa50e60000"], 0x10) close_range(r7, 0xffffffffffffffff, 0x200000000000000) 1m19.781874977s ago: executing program 6 (id=3334): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000980)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x2, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0xa}) preadv(r0, &(0x7f0000000500)=[{&(0x7f0000000400)=""/220, 0xdc}], 0x1, 0xb, 0x401) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x4000000) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) unshare(0x2040400) r7 = socket$pptp(0x18, 0x1, 0x2) connect$pptp(r7, &(0x7f0000000080)={0x18, 0x2, {0x0, @rand_addr=0x64010102}}, 0x1e) 1m18.344159401s ago: executing program 6 (id=3339): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000000180), 0x4) sendmsg$TIPC_CMD_RESET_LINK_STATS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {{}, {}, {0xc, 0x14, 'syz0\x00'}}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20000098}, 0x8098) r1 = socket$igmp(0x2, 0x3, 0x2) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, 0x0, 0x0) setns(r3, 0x24020000) r5 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = syz_pidfd_open(r5, 0x0) setns(r6, 0x24020000) mount(0x0, &(0x7f00000000c0)='.\x00', 0x0, 0x2251024, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r1, 0x0, 0xd2, &(0x7f0000000000)={@broadcast, @multicast1, 0x0, "12ceaac82ab7d944e84b6fbd6178697e3b10c9b81bede26c85ee73daab4158e8", 0x2, 0x6, 0x4, 0x4}, 0x3c) close(0x3) 1m17.466757269s ago: executing program 6 (id=3344): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, r1, &(0x7f0000000040)={0xe0002005}) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e24, @multicast2}, 0x10) sendmmsg$inet(r0, &(0x7f0000004980), 0x0, 0x20008000) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x4000000000001, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) getsockopt$bt_l2cap_L2CAP_CONNINFO(0xffffffffffffffff, 0x6, 0x2, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x109001, 0x0) mount$tmpfs(0x0, 0x0, &(0x7f0000001240), 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x19) (fail_nth: 3) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) 1m16.696909477s ago: executing program 6 (id=3346): socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1f, 0x0, 0x0, 0x1000, 0x0, 0x1}, 0x48) mmap(&(0x7f0000b02000/0x3000)=nil, 0x3000, 0x1000002, 0x28011, r0, 0x3000) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x4001, 0x3, 0x288, 0x160, 0x0, 0x148, 0x0, 0x148, 0x1f0, 0x240, 0x240, 0x1f0, 0x240, 0x7fffffe, 0x0, {[{{@ip={@rand_addr, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x0, 'ip6gretap0\x00', 'veth1_to_batadv\x00', {0xff}, {}, 0x88, 0x0, 0x54}, 0x0, 0xf8, 0x160, 0x0, {}, [@common=@unspec=@time={{0x38}, {0x1, 0x76, 0xb75e, 0x5a3e, 0x4, 0x20}}, @common=@inet=@multiport={{0x50}, {0x0, 0x0, [0x0, 0xffff, 0x0, 0x4e24, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], [0xdf]}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0xa52531e464ddd335, 0x0, 0xfffffffd, 0x3, 'pptp\x00', 'syz1\x00'}}}, {{@ip={@loopback, @multicast1, 0xffffff00, 0x0, 'veth1_to_batadv\x00', 'team_slave_1\x00', {}, {0xff}, 0x5c, 0x1, 0x14}, 0x0, 0x70, 0x90}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2e8) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x146b, 0x902, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xb0, 0x0, "", [{{0x9, 0x4, 0x0, 0x7, 0x19, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x8, 0x3, 0x1, {0x22, 0x29}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x4, 0xff, 0xff}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) 1m14.667314683s ago: executing program 6 (id=3356): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2b18094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x12d) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0), 0x7, 0xab561) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/mem_sleep', 0x80802, 0xcd) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000080)={r2, 0x0, {0x0, 0x0, 0x0, 0x2, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0xd, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d6731ead13b184dbb7d69098c8b534e2e5516bdd8a0f35", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce4, 0x6]}}) pwritev2(r1, &(0x7f0000000880)=[{&(0x7f0000000400)="d1", 0x1}], 0x1, 0xff, 0x7, 0x18) 1m13.665303468s ago: executing program 6 (id=3361): r0 = timerfd_create(0x0, 0x80000) read(r0, &(0x7f0000000140)=""/250, 0xfa) timerfd_settime(r0, 0x3, &(0x7f0000000000)={{0x77359400}, {0x0, 0x989680}}, 0x0) 1m7.095446927s ago: executing program 1 (id=3394): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000404c05f20dafd60000000109022400010000000009040000010300010009210101000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="000657"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000e40)={0x84, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f0000000240)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYRES32=0x0, @ANYBLOB="0198000000000000400012a00b000100697036746e6c00003000028014000300fc01000000000014000200fc010000000000000000000000000001d0e86c1b761440361820a4c5361651244b8cccbab43efa30f5a397659800bc5ced99ff767175cf0bb363b76600def2824e77e94572ad51a0d5c9018d7baea96dbee664a924d3dddcda980856245caf087db859a09ba1ee4c3567ba3819adf71df11aa8bd3b1600"/174], 0x60}}, 0x0) sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000000900010073797a310000000054000000030a01020000000000000000010000000900030073797a320000040028000480080002400000000008000140000000051400030076"], 0xe8}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="1400000010000100000000000000ca000600000a58000000160a0302000200000000000002000000e221157783c9da67fd8b501a8e090002"], 0x80}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x5, 0x84) sendmsg$NFT_BATCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB], 0x110}}, 0x0) r5 = syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r5, &(0x7f0000000340)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0xb, 0x0, 0x0) 1m2.869601389s ago: executing program 1 (id=3419): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0xb0, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @acquire={0x40046305, 0x3}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000240)={@fd={0x66642a85, 0x0, r1}, @flat=@weak_binder={0x77622a85, 0x1100, 0x2}, @flat=@handle}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x40}], 0x0, 0x0, 0x0}) 1m2.575040917s ago: executing program 1 (id=3423): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000140)=ANY=[], 0x32600) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="01002dbd7040fcdbdf251b00000008009a0002"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001280), r3) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r3) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000340)={'batadv0\x00', 0x0}) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f00000003c0)=0x0, &(0x7f0000000400)=0x4) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000500)={'tunl0\x00', &(0x7f0000000440)={'syztnl1\x00', 0x0, 0x7800, 0x20, 0x4, 0x40, {{0x1a, 0x4, 0x0, 0x3, 0x68, 0x629, 0x0, 0x44, 0x4, 0x0, @broadcast, @multicast2, {[@timestamp_addr={0x44, 0x34, 0x6a, 0x1, 0x8, [{@broadcast, 0x1}, {@remote, 0x8}, {@rand_addr=0x64010102}, {@multicast1, 0x1000000}, {@broadcast, 0x7}, {@multicast1, 0xcb}]}, @ra={0x94, 0x4, 0x1}, @rr={0x7, 0x1b, 0x3a, [@multicast2, @remote, @local, @private=0xa010100, @rand_addr=0x64010101, @rand_addr=0x64010100]}]}}}}}) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r10, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) r12 = syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r10) sendmsg$BATADV_CMD_GET_DAT_CACHE(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r12, @ANYBLOB="030302000000fedbdf250600000008000300", @ANYRES32=r11], 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4050) getsockname$packet(r0, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000580)=0x14) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000640)={'ip6tnl0\x00', &(0x7f00000005c0)={'syztnl0\x00', 0x0, 0x2f, 0x2, 0x10, 0x5be, 0x43, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @loopback, 0x700, 0x80, 0x3}}) r13 = socket$inet6(0xa, 0x1, 0x0) r14 = dup2(r13, r13) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r14, 0x8933, &(0x7f0000000240)={'batadv_slave_0\x00', 0x0}) ioctl$sock_inet6_SIOCDELRT(r14, 0x890c, &(0x7f00000000c0)={@remote, @loopback, @mcast2, 0x40003, 0x40, 0xfff8, 0x100, 0x0, 0x590043, r15}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000700)={'syztnl1\x00', &(0x7f0000000680)={'ip6tnl0\x00', 0x0, 0x29, 0x9, 0x1, 0x5, 0x16, @private1={0xfc, 0x1, '\x00', 0x1}, @private1, 0x0, 0x20, 0x0, 0xfffffff8}}) sendmsg$ETHTOOL_MSG_CHANNELS_GET(0xffffffffffffffff, &(0x7f0000000940)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x802800}, 0xc, &(0x7f0000000900)={&(0x7f0000000980)={0x154, r6, 0x745c686946b9eed4, 0x70bd2c, 0x25dfdbff, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}]}, @HEADER={0x88, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'tunl0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1\x00'}]}, @HEADER={0x4}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0xed32d83e1d0ed057}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r16}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gretap0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_0\x00'}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x8e1f700a5801a51d}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x8081}, 0x24040800) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x1c, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}}, 0x1c}}, 0x20004000) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0xc0, r2, 0x4, 0x70bd27, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x9, 0x1e}}}}, [@NL80211_ATTR_TESTDATA={0x48, 0x45, "bbc2db17a2038a3afbc427295ee4ab0745221a7d0975346f9af11c8841f6e999e980a7f80ae8be00c9ac0ba943969f071e008bae211fab8425ffc4415771d2c3847a74ef"}, @NL80211_ATTR_TESTDATA={0x4f, 0x45, "dc1bc2bc082c9bc5b3dfcdd11239008e5675f82ff206b79d093c6661b565072937342c4c97ec5186478061021b25b1c7767602ae0da9ef010fab091f4fdf1632374ae9329142c36f0f1e03"}]}, 0xc0}, 0x1, 0x0, 0x0, 0x80}, 0x20000001) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x2000001, 0x12, r0, 0x0) setuid(0xee01) ioprio_set$pid(0x2, 0x0, 0x0) lsm_list_modules(0x0, &(0x7f0000000000), 0x0) 1m2.15185237s ago: executing program 1 (id=3427): r0 = socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$inet_sctp(r0, &(0x7f00000002c0)={&(0x7f0000000080)=@in6={0xa, 0x4e23, 0x0, @loopback, 0x4}, 0x1c, &(0x7f0000000240)=[{&(0x7f00000000c0)="2f8cd67e205bb3596bd4304f8d2ec73e684d4503d5b2e3ee21f6e13d0f972e3c8d1834878c3d7a4e2f370ed784fa9f211bd3a3a8e03009c5a97e62df8a9addfa8951318c00747867affa1aeec6e294ce4fa77db704909f03256cfb024183affba648904b8ed88f05c89b541bf7f537e0e6f8aedc1291c6bd709e59795ace976aae66f32af0", 0x85}, {&(0x7f0000000180)="9186bf4c1c780ad8c1bd6e927f0e40e9226a6ee5e75e1a74d7", 0x19}, {&(0x7f00000001c0)="ebf6486d383832e6bdd2526d22bf167854fb8d79e28a3f8748e6bb13d49879a4e892dc191baa6ea3426bf2b9b8f2debb0ce7ab2f1a1f8da3d97d70bd9b4d879062fe210d38d13c0a516e42f7ffb726ff13a1921317879de805a7c7f1bdaa9c9d", 0x60}], 0x3, &(0x7f0000000280)=[@dstaddrv6={0x20, 0x84, 0x8, @local}, @dstaddrv6={0x20, 0x84, 0x8, @remote}], 0x40, 0x8000}, 0x200008c1) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1e, &(0x7f00000004c0)=[@in6={0xa, 0x4e2a, 0x9, @private0={0xfc, 0x0, '\x00', 0x3}, 0x2}, @in={0x2, 0x4e21, @empty}]}, &(0x7f0000000240)=0x10) r2 = syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x8000) ioctl$VIDIOC_SUBDEV_S_FRAME_INTERVAL(r2, 0xc0305616, &(0x7f0000000000)={0x0, {0x2, 0x7fffffff}}) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000340)={0x0, 0x10, &(0x7f0000000300)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000380)=0x10) syz_usb_connect(0x2, 0x2d, &(0x7f00000010c0)=ANY=[@ANYBLOB="12010000eafa7240936901b0293df400100109021b000124a8008009040000010300"], 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x48c0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000003c0)={r3, 0x6}, &(0x7f0000000400)=0x8) 59.404744628s ago: executing program 1 (id=3439): r0 = socket$pptp(0x18, 0x1, 0x2) connect$pptp(r0, &(0x7f0000000080)={0x18, 0x2, {0x0, @rand_addr=0x64010102}}, 0x1e) 58.436186524s ago: executing program 34 (id=3361): r0 = timerfd_create(0x0, 0x80000) read(r0, &(0x7f0000000140)=""/250, 0xfa) timerfd_settime(r0, 0x3, &(0x7f0000000000)={{0x77359400}, {0x0, 0x989680}}, 0x0) 8.45377277s ago: executing program 5 (id=3737): r0 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) symlink(&(0x7f0000000540)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000380)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\'\x00\x00\x00\a'], 0x50) pwrite64(r1, &(0x7f0000000000)='2', 0x1, 0x7) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r2, &(0x7f0000000000), 0xd) 6.507451705s ago: executing program 5 (id=3744): syz_genetlink_get_family_id$netlbl_mgmt(0x0, 0xffffffffffffffff) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)) syz_clone3(&(0x7f0000000080)={0x901400, &(0x7f0000000040), 0x0, 0x0, {0xa}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='children\x00') bind$netlink(0xffffffffffffffff, &(0x7f00000006c0)={0x10, 0x0, 0x25dfdbff, 0x800000}, 0xc) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000001340)=0x18, 0x4) pread64(r0, &(0x7f0000000300)=""/4092, 0xffc, 0x4) r1 = fsopen(&(0x7f0000000140)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) 6.261517341s ago: executing program 5 (id=3745): r0 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000200)=ANY=[@ANYBLOB="1201010200000040b421810040000102030109026e0003017f0006080b13e94851ffa3d8531c68f9f88f759b000201223023090410fdae0c8f74301e071998d9d024c3000000010130000a2401100a00090000080904010000010230000904010101010230000905010960002503052d7200000404020000010000010000"], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x7542d000) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000005240), 0x4000095, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=@newqdisc={0x40, 0x24, 0x1, 0x200000, 0x0, {0x60, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x10, 0xfffa}}, [@TCA_RATE={0x6, 0x5, {0x1, 0x40}}, @qdisc_kind_options=@q_pfifo={{0xa}, {0x8, 0x2, 0x401}}]}, 0x40}}, 0x24040004) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000002c0)={'tunl0\x00', &(0x7f0000000100)={'syztnl0\x00', r5, 0x20, 0x7, 0x0, 0x0, {{0x25, 0x4, 0x1, 0x3, 0x94, 0x64, 0x0, 0x3, 0x29, 0x0, @local, @broadcast, {[@generic={0x89, 0x8, "40aade9eba3d"}, @noop, @noop, @end, @cipso={0x86, 0x27, 0xffffffffffffffff, [{0x2, 0x12, "0c6271b255cd234178f1910f0acb7879"}, {0x5, 0xf, "6b766e202d696927c412e81733"}]}, @lsrr={0x83, 0x7, 0x79, [@multicast1]}, @cipso={0x86, 0x38, 0x3, [{0x1, 0x3, "e4"}, {0x1, 0x11, "72ab6d53afdedec20f8bce9dc4e6df"}, {0x2, 0x6, "ec2e65c8"}, {0x0, 0x5, "a74fe2"}, {0x0, 0xd, "78adf2714641c762c1e03b"}, {0x7, 0x6, "1ad152d9"}]}, @noop, @generic={0x89, 0x4, "9b04"}, @lsrr={0x83, 0x7, 0x32, [@remote]}]}}}}}) sendmsg$ETHTOOL_MSG_STRSET_GET(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)={0x34, r2, 0x321, 0x70bd2b, 0x25dfdbfb, {}, [@ETHTOOL_A_STRSET_STRINGSETS={0x1c, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}]}]}, @ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0x4c811}, 0x4) getsockopt$sock_buf(r1, 0x1, 0x19, &(0x7f0000002f80)=""/217, &(0x7f0000003080)=0xd9) syz_usb_control_io$uac3(r0, 0x0, 0x0) 5.419876469s ago: executing program 3 (id=3749): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000001c0)={'veth0\x00', 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x140) r3 = open_tree(0xffffffffffffffff, &(0x7f0000000240)='./bus\x00', 0x2) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000280)={@ipv4={'\x00', '\xff\xff', @local}, 0x1, 0x2, 0x2, 0x8, 0x4, 0x1}, 0x20) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000006c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x3}, 0x50) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x3, 0x1c, &(0x7f0000001840)=@ringbuf={{0x18, 0x6}, {{0x18, 0x1, 0x1, 0x0, r5}}, {}, [@snprintf={{}, {0x5, 0x3, 0x3, 0xa, 0x9}, {0x5}, {0x3, 0x3, 0x3, 0xa, 0xa}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r4}, {}, {0x15, 0x0, 0x0, 0x76}}], {{}, {0x5}, {0x28}}}, &(0x7f0000000340)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000005c0)={'gre0\x00'}) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r9, 0x4140aecd, &(0x7f00000004c0)) fgetxattr(r3, &(0x7f0000000140)=@random={'osx.', 'overlay\x00'}, &(0x7f0000000600)=""/183, 0xb7) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000000c0)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0xa41, 0x0) linkat(0xffffffffffffff9c, &(0x7f00000006c0)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file7\x00', 0x1000) sendmsg$nl_route_sched(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x400000c6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x48801}, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="58000000020601010700000000000000050000050c000780050015001d0000000500010006000000050005000200000005000400000000000900020073797a300000000011000300686173683a69702c706f7274"], 0x58}, 0x1, 0x0, 0x0, 0x814}, 0xc400) 4.602326324s ago: executing program 3 (id=3754): socket$unix(0x1, 0x5, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, 0x0, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) unshare(0x6020400) bpf$MAP_LOOKUP_BATCH(0x18, 0x0, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x6000) setresuid(0xee01, r1, r1) io_uring_setup(0xa71, &(0x7f0000000240)={0x0, 0x86a1, 0x1, 0x3, 0x276}) socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2, 0x0, 0x0) sendmsg$inet(r2, &(0x7f0000000200)={&(0x7f0000000240)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x2404c851) r3 = mq_open(&(0x7f0000000480)='!sel\x00\x00\x00\x10\x00\x00\x00\x00\xd7\\P\xc1\xde.O\xcb]0y\x00\x00\x00\x00\x00\x00\x00\x00', 0x6e93ebbbcc0884f2, 0x196, &(0x7f0000000440)={0x2000000000002000, 0x1, 0x56, 0x3}) mq_timedsend(r3, 0x0, 0x0, 0x9, 0x0) mq_timedsend(r3, 0x0, 0x0, 0x0, 0x0) 3.800031796s ago: executing program 5 (id=3758): r0 = syz_io_uring_setup(0xf04, &(0x7f0000000080)={0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x2a, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x8040}) io_uring_enter(r0, 0x1, 0x1, 0x1, 0x0, 0x0) 3.482643167s ago: executing program 5 (id=3760): mknod$loop(0x0, 0x1000, 0x1) openat$sequencer(0xffffff9c, &(0x7f0000000040), 0x2000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) socket$can_j1939(0x1d, 0x2, 0x7) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) unshare(0x6020400) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) 2.995436621s ago: executing program 5 (id=3762): r0 = socket(0x400000000010, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001b80)=ANY=[@ANYBLOB="0b000000080000000c0000000000008001000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000400704d9af6e77f6f9fa2692754aa6bc03aeecf427fda3fa531e9be8a73ea2845031e1f076d99cf68e2bcfb7208a52f23c0481324755ae7eaf13e63320073b755b096f40842dde2431fb6e73c0174b3589589483609044525a9c14542ac972f90d222f139e249acef79c71bd78a14cd26534f68d41c8cd0432abfb291b4f4e4db85cbec5408a51288b18c52b3ae55d8d73edd1e1c"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r1}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000080000000000b7080000000000007b8bf8ff00000000bfa2000000000000436984072b507ceea7d0c7be75316902db1f2ed0020000f8ffffffb703000008000000b704000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r2, 0x2000000, 0xe, 0x48, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x81802) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r6, &(0x7f0000001b00)=[{{&(0x7f0000000500)=@qipcrtr, 0x80, &(0x7f0000001780)=[{&(0x7f0000000680)=""/4096, 0x1000}, {&(0x7f0000001680)=""/225, 0xe1}], 0x2, &(0x7f00000017c0)=""/249, 0xf9}, 0xf5b}, {{&(0x7f00000018c0)=@phonet, 0x80, &(0x7f0000001a80)=[{&(0x7f0000001940)=""/8, 0x8}, {&(0x7f0000001980)=""/223, 0xdf}], 0x2, &(0x7f0000001ac0)=""/15, 0xf}, 0x4}], 0x2, 0x2, 0x0) syz_open_dev$vim2m(0x0, 0x1000, 0x2) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x6) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x14, &(0x7f0000000340)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@tail_call, @call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r3}}, @map_idx_val={0x18, 0x1, 0x6, 0x0, 0xe, 0x0, 0x0, 0x0, 0x2}, @tail_call={{0x18, 0x2, 0x1, 0x0, r1}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r9, 0x0, 0x14, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x320e, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) sendmsg$nl_route_sched(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r4, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0xd}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x4c840) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000040)=@newtfilter={0x3c, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xfff3, 0xfff3}, {0x0, 0xfff3}, {0x2, 0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ENC_IPV4_DST={0x8, 0x1d, @multicast1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x0) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x66) syz_usb_connect$sierra_net(0x0, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x1199, 0x68a3, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, "", {{0x9, 0x4, 0x7, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0x43978451d8f6fedb, 0x2, 0x0, 0x2, 0xb, 0xfe}, {0x9, 0x5, 0xc, 0x2, 0x200, 0xc, 0x77, 0x3}, {0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0xfc, 0x32}}}}}}]}}, 0x0) ioctl$UI_END_FF_ERASE(r10, 0x400c55cb, 0x0) syz_usb_connect$uac1(0x5, 0x72, &(0x7f0000000040)=ANY=[@ANYBLOB="120110030000151088057d1bf3ed78352a670cc10bdee400c00001000301090260000301f140020904", @ANYRESOCT=0x0], &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0}) 2.928563397s ago: executing program 3 (id=3763): socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)) syz_clone3(&(0x7f0000000080)={0x901400, &(0x7f0000000040), 0x0, 0x0, {0xa}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='children\x00') bind$netlink(0xffffffffffffffff, &(0x7f00000006c0)={0x10, 0x0, 0x25dfdbff, 0x800000}, 0xc) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000001340)=0x18, 0x4) pread64(r0, &(0x7f0000000300)=""/4092, 0xffc, 0x4) r1 = fsopen(&(0x7f0000000140)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) 2.41077776s ago: executing program 3 (id=3767): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r3 = socket$inet6(0xa, 0x3, 0x7) sendmmsg(r3, 0x0, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x54, r5, 0x1, 0x0, 0x25dfdbfe, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}}, {0x14, 0x2, @in={0x2, 0x4e24, @multicast1}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}]}]}, 0x54}}, 0x40000000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x2, 0x60b924, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x2}, {0x6, 0xb}, {0xc, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x2400c0e0}, 0x20004080) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x1e, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000fcffffff0000000000000000791208000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYRES32=r6, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYRES16, @ANYRES32], 0x44}}, 0x2000040) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000001c0)=@srh={0x3c, 0xa, 0x4, 0x5, 0x3, 0x20, 0x6, [@ipv4={'\x00', '\xff\xff', @multicast1}, @mcast1, @local, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @empty]}, 0x58) write$UHID_SET_REPORT_REPLY(0xffffffffffffffff, &(0x7f0000002c40)=ANY=[@ANYBLOB="0e000000040000000f0cab00efe30fab8e421c310652188e246926f4f2bc50c6b199504994ab89fc6a576722ccca32eaf84c3170c21f371085d40c77771598e9c7de4f1d652f4841817531e8b21f026f5e3a17e169b4762ea557c7773f439ab27222717091f62d00d9c545fa96726dec59d5a61ca7f55eb04ccd7c5b0a248dac1a87fd4adb1c68d97e975603c213fd73cecd8b9a46076cbcf0faa230bb323cb22e0876ff5d4b2cbcb3203f8d00"/183], 0xb7) ioctl$sock_SIOCGIFINDEX_802154(r7, 0x8933, &(0x7f0000000180)={'wpan3\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000b40)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000340)=@newchain={0x790, 0x64, 0x2, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0xd, 0xb}, {0x3, 0x5}, {0xf, 0xffff}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x718, 0x2, [@TCA_CGROUP_POLICE={0x430, 0x2, [@TCA_POLICE_RATE={0x404, 0x2, [0x7, 0x5, 0x2c77, 0x7f, 0xffff, 0xa1a, 0x7, 0x7, 0x10, 0x7, 0x8, 0x5, 0x958, 0x9, 0xc, 0x7fff, 0x4de, 0x4, 0x0, 0x5, 0x5, 0x6, 0x0, 0xf, 0x9, 0x7, 0x1, 0x55c2, 0x4, 0xfe39, 0x5, 0x200, 0x9, 0xd, 0xf83, 0xf98, 0x400, 0xe2f, 0xa, 0x6, 0xe, 0x62, 0x3, 0x1ea, 0x3ff, 0x9, 0x3, 0x2, 0x9, 0x13, 0x1ff, 0xbf, 0x9, 0x18, 0x2, 0x1, 0x1, 0x0, 0x600, 0x5, 0x8, 0x8, 0x8000, 0xf137, 0x4, 0xc, 0x8a4, 0x7, 0x9b61, 0xffffff62, 0x0, 0x6, 0xb, 0xbc, 0x6, 0x80000000, 0x7ff, 0x0, 0x4, 0x4, 0x7fffffff, 0x48, 0x9, 0x3ff, 0xa6b9, 0xb9, 0x5, 0x2, 0x5, 0x9, 0x1, 0xc, 0x80000000, 0x0, 0x47, 0x0, 0x9, 0xa9, 0x1, 0xffff8001, 0x9, 0x10, 0x2, 0x3, 0xb, 0x2, 0x200, 0x7f, 0x2, 0x3, 0x120, 0x4800000, 0xfffffff9, 0x0, 0x4, 0x1, 0x1, 0x9, 0x8, 0x5ca, 0xe, 0x455d, 0x4, 0x9, 0x7, 0x10, 0x10001, 0x3aa9, 0x0, 0x9, 0x7, 0x0, 0x0, 0x9, 0xfffffffd, 0x2fe, 0x80000000, 0x3, 0x9877, 0x80000000, 0x22b, 0x5, 0x2122, 0x6e, 0xb, 0x100, 0xffffffff, 0x6, 0xd, 0x2, 0x5, 0x3ff, 0x3, 0x3, 0x4, 0x6, 0x4, 0x4, 0x1, 0x321f26cf, 0xffffffff, 0x6, 0xc6, 0x1, 0x716, 0x5, 0x0, 0x80000000, 0x7ff, 0x5, 0x4, 0xafc5, 0x80000001, 0x2, 0x6, 0x0, 0x9, 0x10000, 0xff, 0xced4, 0x7, 0x3, 0xc, 0x1, 0x5, 0x48a8, 0x0, 0x5, 0x1, 0x6, 0xfffffff9, 0x8, 0x6, 0x9, 0x0, 0x4, 0x3, 0x101, 0x6, 0x7, 0x6, 0xa0, 0xe, 0x6, 0x1, 0x8000, 0x10000, 0x6ae, 0x1, 0x7, 0x5, 0xa7, 0xcd, 0x0, 0xcd, 0x3, 0x57d281ae, 0x0, 0x0, 0x401, 0xa03, 0x7, 0xfea, 0x78, 0xd, 0x5, 0x8, 0x6, 0x7, 0x4, 0x100, 0x40000000, 0xa69, 0x9, 0x100, 0x8, 0x0, 0x8, 0x8, 0xffffff05, 0x1ff, 0xe15e, 0x1, 0x10000, 0x6, 0xfffffffe, 0x8, 0x80000001, 0x0, 0x1, 0x1, 0x401, 0x364e, 0x0, 0xffff, 0x2]}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x8}, @TCA_POLICE_RESULT={0x8, 0x5, 0x3}, @TCA_POLICE_RESULT={0x8, 0x5, 0x139}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x7}]}, @TCA_CGROUP_ACT={0xe8, 0x1, [@m_gact={0xe4, 0x20, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x850, 0x7, 0x20000000, 0x200, 0x5}}]}, {0x9d, 0x6, "6e30300f5337b6124290aad955784162667c3065f211f040df49c28a3d63c93d97d1a03d2ba8f0bf425d9d4c532c8e6ea1a1806c10ef7daea1aeed01c7cf7ce230a423922f2d83def17665fc61dd507afbe63bf74b2d7c0febe8f79a67449dca7ba3f46978d8c8019e9356634520e6e218f67e36a9d179c3134ed17361388caf18434077a3761ae3836b84fe181bb5e74afb0ae02a9dc6efcb"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}, @TCA_CGROUP_ACT={0x1fc, 0x1, [@m_simple={0xf4, 0x5, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_DEF_PARMS={0x18, 0x2, {0x2008000, 0x7, 0x4, 0xfffffffd, 0x1}}, @TCA_DEF_DATA={0xd, 0x3, '\x7f^-/*}^@\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x80000000, 0x101, 0x4, 0x6, 0xb}}]}, {0x88, 0x6, "ec34d8ff9fde5385366e37d3877a4099eda49e015c9131b08df293f44cfe739835e0e81b0d4f9ab13bea6a4efeb1a3450376431b19eee0c08399b24bb8a5069314835f67778b9c37c2b32090c2ae82f001ea34c77fe777e141c926b4cf976d1adb79ff3be5228200e23bf2a29e98fe19348b32fecedaf2d99b100c7fbc6a729fbe08efe2"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_mpls={0x104, 0xd, 0x0, 0x0, {{0x9}, {0x54, 0x2, 0x0, 0x1, [@TCA_MPLS_LABEL={0x8, 0x5, 0x5a6e3}, @TCA_MPLS_TC={0xfffffffffffffe2e, 0x6, 0x1}, @TCA_MPLS_TTL={0x5, 0x7, 0xcc}, @TCA_MPLS_TTL={0x5, 0x7, 0x1}, @TCA_MPLS_TTL={0x5, 0x7, 0x8}, @TCA_MPLS_PROTO={0x6, 0x4, 0xdc6d}, @TCA_MPLS_TTL={0x5, 0x7, 0x35}, @TCA_MPLS_PROTO={0x6, 0x4, 0x6003}, @TCA_MPLS_LABEL={0x8, 0x5, 0xdf937}, @TCA_MPLS_PROTO={0x6, 0x4, 0x8884}]}, {0x86, 0x6, "3ecea276b4fb9b5c198000618bf21a332dd93b156d829b47e3584496d17fc6f64f970cd19501b625e0d4877a19e664620e918a7effd3318e575aae14fbc0333f8bb13074bd94d7603b333150ff0fcd24e93c05dd9ce3b02e276847b2bada3aa363e2018b5982d6ff6d18b0648416e61f906e366fb730100eb6bb6601f6ace52cb089"}, {0xc}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x9c, 0xf9}}, @TCA_RATE={0x6, 0x5, {0x31, 0x8}}, @TCA_CHAIN={0x8, 0xb, 0xd281}, @TCA_RATE={0x6, 0x5, {0x1, 0x80}}, @TCA_CHAIN={0x8}, @TCA_CHAIN={0x8, 0xb, 0x4}, @TCA_RATE={0x6, 0x5, {0x2}}, @TCA_CHAIN={0x8, 0xb, 0xc}, @TCA_CHAIN={0x8, 0xb, 0x10001}]}, 0x790}, 0x1, 0x0, 0x0, 0xaae569cbb32c24c9}, 0x80) prctl$PR_SCHED_CORE(0x3e, 0x4, 0x0, 0x1, &(0x7f0000002bc0)) ioctl$XFS_IOC_FSGETXATTRA(r4, 0x801c582d, &(0x7f0000000240)) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000002e00090027097000000000220400000008000c"], 0x28}, 0x1, 0x0, 0x0, 0x42804}, 0x0) 1.967729601s ago: executing program 3 (id=3770): mknod$loop(0x0, 0x1000, 0x1) openat$sequencer(0xffffff9c, &(0x7f0000000040), 0x2000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) socket$can_j1939(0x1d, 0x2, 0x7) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) 1.600908337s ago: executing program 3 (id=3771): socket$unix(0x1, 0x5, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, 0x0, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) unshare(0x6020400) bpf$MAP_LOOKUP_BATCH(0x18, 0x0, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x6000) setresuid(0xee01, r1, r1) io_uring_setup(0xa71, &(0x7f0000000240)={0x0, 0x86a1, 0x1, 0x3, 0x276}) socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2, 0x0, 0x0) sendmsg$inet(r2, &(0x7f0000000200)={&(0x7f0000000240)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x2404c851) r3 = mq_open(&(0x7f0000000480)='!sel\x00\x00\x00\x10\x00\x00\x00\x00\xd7\\P\xc1\xde.O\xcb]0y\x00\x00\x00\x00\x00\x00\x00\x00', 0x6e93ebbbcc0884f2, 0x196, &(0x7f0000000440)={0x2000000000002000, 0x1, 0x56, 0x3}) mq_timedsend(r3, 0x0, 0x0, 0x9, 0x0) mq_timedsend(r3, 0x0, 0x0, 0x0, 0x0) 903.385651ms ago: executing program 2 (id=3777): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff0000/0xd000)=nil, &(0x7f0000ff3000/0x4000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000140)='./bus\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x141091, 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000300)={[{@xino_off}, {@xino_on}, {@redirect_dir_nofollow}, {@workdir={'workdir', 0x3d, './file0/../file0'}}], [{@subj_user={'subj_user', 0x3d, 'xino=on'}}, {@fscontext={'fscontext', 0x3d, 'sysadm_u'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r0, 0xc01064c8, &(0x7f0000000940)={0x1, 0x0, &(0x7f0000000900)=[0x0]}) ioctl$DRM_IOCTL_MODE_GETGAMMA(r0, 0xc02064a4, &(0x7f00000001c0)={r1, 0x0, 0x0, 0x0, 0x0}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x400c804) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000480), 0xc6c00) io_uring_setup(0x6a33, &(0x7f0000000040)={0x0, 0xc8a1, 0x40, 0x3, 0xbd, 0x0, r2}) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/kernel/fscaps', 0x400, 0x4) read$FUSE(r3, &(0x7f0000000500)={0x2020}, 0x2020) preadv(r3, &(0x7f0000003ec0)=[{&(0x7f0000002880)=""/189, 0xbd}], 0x1, 0xf, 0x1) r4 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001f80), 0x2, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r4, &(0x7f0000001fc0)={0x42, 0x3, 0x300, {0x0, 0x21, 0x0, '/proc/sys/net/ipv4/vs/secure_tcp\x00'}}, 0x42) io_uring_setup(0x23c3, &(0x7f0000000240)={0x0, 0x89c0, 0x4000, 0x3, 0x34, 0x0, r3}) pselect6(0x40, &(0x7f0000000100)={0x0, 0x1}, &(0x7f0000000000)={0x1f, 0x2, 0x1, 0xffffffffffff8000}, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./file0\x00', 0x3a) mount(&(0x7f00000000c0), &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='9p\x00', 0x0, &(0x7f0000000080)='trans=tcp,') bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1a00000004"], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b7020000f7ffffffbfa70000000000002402000020fe29817a0af0fff8ffffff69a4f0ff00000000b70600000018d1fe2d6405000000000075040000000000400704000000000000b7040000100000206a0700fe000000008500000005000000b70000000a00000095000000000000000000c2c62f6004ad13aa957e2af5e49a53c2868f0399d909a63796c113a80c19aab9d607000000b6c9483be3f0d3253730e714c46cc4f79fd2b316da4f0de8163f6242fa7323f1740637c48468766af540439fce41f144631ac262dcae18c3d1a1fbe96dc86035b44174f7c0620254ab6d285e6b343185089a0f119e31975e551558050800000000000000125d67857f290870093f38153608561a2128a79cce912d1f05de330800a9f5422bee8ca49166f6a587f2f593775afcd071efc5a972f757521b7b38ec273c2ad3e406f8c124f7dc1c4553229a69df4b2780e6da4420d71489fe383e0b5ce08b750502f2b8add8d2dddde19ac050537e973782b4053150580035fb2c579e1b2100000033d1ee8cab6d236f05b1f7b9f78fd5abfe033eb79f7a0b498366f5edfe311258016fbf47d9c85bf5325bf61419372be377022433e20900a262b20bb8b36de7b0e6c5ebfc5baec1ebe58d4af587d33e2935ad68da6e0fea5c21301f5d002b51a5b60fc741cb2c5d4cd5e896774f9293a6435558795043404ac6eafc8310fbcacca7f971b260fd06d4590ded8429fcd1c9a8dbbdedb32675388df363c0bc536e00448208b72405ebf27ddb402e5a2d675aaad92e183cef1eadc1661140fb567b55c72907a1aca75277a5f0022b1e957ba737f10f1161c5ae6e2cc64072ff3b4e76084922242e63d4b7806e30f786cff147e4bc819060678319a0e5534f5a0db52526c30000000000000000000000a63705b1a60525620acca06d57c055059df7651768310c9085c5f86be6ab819506961ad51f18b35fdc3fd4d0a0dbbdcd494ef168931f27748787bee95d739fef7ee67dd21c34647de82707e41d7db6d981a4fcf0bbd3d38ebb7a2489e28c6b28c0f70092ffb016b7766399555f3e6b538c2c862d17e53eaeb2036f9f0ab6e95e71bda4b5bbf53344264ad93bac1207b31d6e9c78181c7fe204c0b7582d1c762857f2a2e0c60f4a4855591a4f70f94df9629e470701103c40c8f6d3a3068091d62b58999e0a046f9509cb8ddc2a9ad4e0f1f85e5f076218b4b931acdff0c34fc5bdbad17ec481f1c9b17727c14e053e315d0d8d03c24ddaba65c5ce5b1aa04d1f767e25662b155d49460ec720d54044ac2856c11407835f341e2614bcae270000000001000000df7f736aab5d713240b2f40ec7be8251eba969686b2670ddc1a84df6ab12ab3e0cf8747837062233935704ebbd943ef0c5fef29513c7c1d6d2611796dccb45bdfd9e6533ad3574be5b9ea70e0c3b41a32067c03f5f8ed147cd0655c90d656f66eaed18a3c284c4f19417b5d91431759356db5d45ea40c9866957105b6252b0c028c672049ce163126f143f5758faf2a43f4c4f45a69b4e9113f85ae531085c11c75edbdee5af454757cdaff396c15ab9b210c202ffaea96d1bac60c6d6c56a4babc659858789bd479334e13e1c7876f95429431e61400815788c1397b260600d78e7513c58d9ac9474d392cc06f789753e1e7ebf5f1b55e2a64b9150c6580bf48e7bff763034801cccf403108d127b959ffc425a563ea2b90fbe779fd7d2ebfe94"], &(0x7f0000000280)='GPL\x00'}, 0x48) r6 = socket$kcm(0x11, 0x2, 0x300) setsockopt$sock_attach_bpf(r6, 0x1, 0x32, &(0x7f0000000000)=r5, 0x4) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_GET_BYNAME(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000002aa429c012120e060103005054325100000000000001"], 0x14}, 0x1, 0x0, 0x0, 0x41}, 0x8040) 828.397827ms ago: executing program 2 (id=3778): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r3 = socket$inet6(0xa, 0x3, 0x7) sendmmsg(r3, 0x0, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x54, r5, 0x1, 0x0, 0x25dfdbfe, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}}, {0x14, 0x2, @in={0x2, 0x4e24, @multicast1}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}]}]}, 0x54}}, 0x40000000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x2, 0x60b924, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x2}, {0x6, 0xb}, {0xc, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x2400c0e0}, 0x20004080) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x1e, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000fcffffff0000000000000000791208000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES32=r6, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYRES16, @ANYRES32], 0x44}}, 0x2000040) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000001c0)=@srh={0x3c, 0xa, 0x4, 0x5, 0x3, 0x20, 0x6, [@ipv4={'\x00', '\xff\xff', @multicast1}, @mcast1, @local, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @empty]}, 0x58) write$UHID_SET_REPORT_REPLY(0xffffffffffffffff, &(0x7f0000002c40)=ANY=[@ANYBLOB="0e000000040000000f0cab00efe30fab8e421c310652188e246926f4f2bc50c6b199504994ab89fc6a576722ccca32eaf84c3170c21f371085d40c77771598e9c7de4f1d652f4841817531e8b21f026f5e3a17e169b4762ea557c7773f439ab27222717091f62d00d9c545fa96726dec59d5a61ca7f55eb04ccd7c5b0a248dac1a87fd4adb1c68d97e975603c213fd73cecd8b9a46076cbcf0faa230bb323cb22e0876ff5d4b2cbcb3203f8d00"/183], 0xb7) ioctl$sock_SIOCGIFINDEX_802154(r7, 0x8933, &(0x7f0000000180)={'wpan3\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000b40)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000340)=@newchain={0x790, 0x64, 0x2, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0xd, 0xb}, {0x3, 0x5}, {0xf, 0xffff}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x718, 0x2, [@TCA_CGROUP_POLICE={0x430, 0x2, [@TCA_POLICE_RATE={0x404, 0x2, [0x7, 0x5, 0x2c77, 0x7f, 0xffff, 0xa1a, 0x7, 0x7, 0x10, 0x7, 0x8, 0x5, 0x958, 0x9, 0xc, 0x7fff, 0x4de, 0x4, 0x0, 0x5, 0x5, 0x6, 0x0, 0xf, 0x9, 0x7, 0x1, 0x55c2, 0x4, 0xfe39, 0x5, 0x200, 0x9, 0xd, 0xf83, 0xf98, 0x400, 0xe2f, 0xa, 0x6, 0xe, 0x62, 0x3, 0x1ea, 0x3ff, 0x9, 0x3, 0x2, 0x9, 0x13, 0x1ff, 0xbf, 0x9, 0x18, 0x2, 0x1, 0x1, 0x0, 0x600, 0x5, 0x8, 0x8, 0x8000, 0xf137, 0x4, 0xc, 0x8a4, 0x7, 0x9b61, 0xffffff62, 0x0, 0x6, 0xb, 0xbc, 0x6, 0x80000000, 0x7ff, 0x0, 0x4, 0x4, 0x7fffffff, 0x48, 0x9, 0x3ff, 0xa6b9, 0xb9, 0x5, 0x2, 0x5, 0x9, 0x1, 0xc, 0x80000000, 0x0, 0x47, 0x0, 0x9, 0xa9, 0x1, 0xffff8001, 0x9, 0x10, 0x2, 0x3, 0xb, 0x2, 0x200, 0x7f, 0x2, 0x3, 0x120, 0x4800000, 0xfffffff9, 0x0, 0x4, 0x1, 0x1, 0x9, 0x8, 0x5ca, 0xe, 0x455d, 0x4, 0x9, 0x7, 0x10, 0x10001, 0x3aa9, 0x0, 0x9, 0x7, 0x0, 0x0, 0x9, 0xfffffffd, 0x2fe, 0x80000000, 0x3, 0x9877, 0x80000000, 0x22b, 0x5, 0x2122, 0x6e, 0xb, 0x100, 0xffffffff, 0x6, 0xd, 0x2, 0x5, 0x3ff, 0x3, 0x3, 0x4, 0x6, 0x4, 0x4, 0x1, 0x321f26cf, 0xffffffff, 0x6, 0xc6, 0x1, 0x716, 0x5, 0x0, 0x80000000, 0x7ff, 0x5, 0x4, 0xafc5, 0x80000001, 0x2, 0x6, 0x0, 0x9, 0x10000, 0xff, 0xced4, 0x7, 0x3, 0xc, 0x1, 0x5, 0x48a8, 0x0, 0x5, 0x1, 0x6, 0xfffffff9, 0x8, 0x6, 0x9, 0x0, 0x4, 0x3, 0x101, 0x6, 0x7, 0x6, 0xa0, 0xe, 0x6, 0x1, 0x8000, 0x10000, 0x6ae, 0x1, 0x7, 0x5, 0xa7, 0xcd, 0x0, 0xcd, 0x3, 0x57d281ae, 0x0, 0x0, 0x401, 0xa03, 0x7, 0xfea, 0x78, 0xd, 0x5, 0x8, 0x6, 0x7, 0x4, 0x100, 0x40000000, 0xa69, 0x9, 0x100, 0x8, 0x0, 0x8, 0x8, 0xffffff05, 0x1ff, 0xe15e, 0x1, 0x10000, 0x6, 0xfffffffe, 0x8, 0x80000001, 0x0, 0x1, 0x1, 0x401, 0x364e, 0x0, 0xffff, 0x2]}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x8}, @TCA_POLICE_RESULT={0x8, 0x5, 0x3}, @TCA_POLICE_RESULT={0x8, 0x5, 0x139}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x7}]}, @TCA_CGROUP_ACT={0xe8, 0x1, [@m_gact={0xe4, 0x20, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x850, 0x7, 0x20000000, 0x200, 0x5}}]}, {0x9d, 0x6, "6e30300f5337b6124290aad955784162667c3065f211f040df49c28a3d63c93d97d1a03d2ba8f0bf425d9d4c532c8e6ea1a1806c10ef7daea1aeed01c7cf7ce230a423922f2d83def17665fc61dd507afbe63bf74b2d7c0febe8f79a67449dca7ba3f46978d8c8019e9356634520e6e218f67e36a9d179c3134ed17361388caf18434077a3761ae3836b84fe181bb5e74afb0ae02a9dc6efcb"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}, @TCA_CGROUP_ACT={0x1fc, 0x1, [@m_simple={0xf4, 0x5, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_DEF_PARMS={0x18, 0x2, {0x2008000, 0x7, 0x4, 0xfffffffd, 0x1}}, @TCA_DEF_DATA={0xd, 0x3, '\x7f^-/*}^@\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x80000000, 0x101, 0x4, 0x6, 0xb}}]}, {0x88, 0x6, "ec34d8ff9fde5385366e37d3877a4099eda49e015c9131b08df293f44cfe739835e0e81b0d4f9ab13bea6a4efeb1a3450376431b19eee0c08399b24bb8a5069314835f67778b9c37c2b32090c2ae82f001ea34c77fe777e141c926b4cf976d1adb79ff3be5228200e23bf2a29e98fe19348b32fecedaf2d99b100c7fbc6a729fbe08efe2"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_mpls={0x104, 0xd, 0x0, 0x0, {{0x9}, {0x54, 0x2, 0x0, 0x1, [@TCA_MPLS_LABEL={0x8, 0x5, 0x5a6e3}, @TCA_MPLS_TC={0xfffffffffffffe2e, 0x6, 0x1}, @TCA_MPLS_TTL={0x5, 0x7, 0xcc}, @TCA_MPLS_TTL={0x5, 0x7, 0x1}, @TCA_MPLS_TTL={0x5, 0x7, 0x8}, @TCA_MPLS_PROTO={0x6, 0x4, 0xdc6d}, @TCA_MPLS_TTL={0x5, 0x7, 0x35}, @TCA_MPLS_PROTO={0x6, 0x4, 0x6003}, @TCA_MPLS_LABEL={0x8, 0x5, 0xdf937}, @TCA_MPLS_PROTO={0x6, 0x4, 0x8884}]}, {0x86, 0x6, "3ecea276b4fb9b5c198000618bf21a332dd93b156d829b47e3584496d17fc6f64f970cd19501b625e0d4877a19e664620e918a7effd3318e575aae14fbc0333f8bb13074bd94d7603b333150ff0fcd24e93c05dd9ce3b02e276847b2bada3aa363e2018b5982d6ff6d18b0648416e61f906e366fb730100eb6bb6601f6ace52cb089"}, {0xc}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x9c, 0xf9}}, @TCA_RATE={0x6, 0x5, {0x31, 0x8}}, @TCA_CHAIN={0x8, 0xb, 0xd281}, @TCA_RATE={0x6, 0x5, {0x1, 0x80}}, @TCA_CHAIN={0x8}, @TCA_CHAIN={0x8, 0xb, 0x4}, @TCA_RATE={0x6, 0x5, {0x2}}, @TCA_CHAIN={0x8, 0xb, 0xc}, @TCA_CHAIN={0x8, 0xb, 0x10001}]}, 0x790}, 0x1, 0x0, 0x0, 0xaae569cbb32c24c9}, 0x80) prctl$PR_SCHED_CORE(0x3e, 0x4, 0x0, 0x1, &(0x7f0000002bc0)) ioctl$XFS_IOC_FSGETXATTRA(r4, 0x801c582d, &(0x7f0000000240)) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000002e00090027097000000000220400000008000c"], 0x28}, 0x1, 0x0, 0x0, 0x42804}, 0x0) 626.76325ms ago: executing program 2 (id=3779): r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r1, 0x0, 0x4004809) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16, @ANYBLOB="010025bd700000000000020000000800", @ANYRES32], 0x3c}, 0x1, 0x0, 0x0, 0x4c854}, 0x4040000) r2 = io_uring_setup(0x524, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) setsockopt$sock_attach_bpf(r1, 0x110, 0x2, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000240)=ANY=[@ANYBLOB='`'], 0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x5) r3 = syz_open_dev$MSR(&(0x7f00000007c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000001c80)=ANY=[@ANYBLOB], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r4, 0x0, 0x48b, &(0x7f0000000040)={0x1, 'veth0_virt_wifi\x00', 0x2}, 0x18) ioctl$PTP_CLOCK_GETCAPS(r0, 0x80503d01, &(0x7f0000000680)) 547.406322ms ago: executing program 2 (id=3780): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000980)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x2, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0xa}) preadv(r0, &(0x7f0000000500)=[{&(0x7f0000000400)=""/220, 0xdc}], 0x1, 0xb, 0x401) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x4000000) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) unshare(0x2040400) r7 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r7, &(0x7f0000000140)={0x18, 0x2, {0xfffe, @loopback}}, 0x1e) connect$pptp(r7, &(0x7f0000000080)={0x18, 0x2, {0x0, @rand_addr=0x64010102}}, 0x1e) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240), 0xc0001, 0x0) ioctl$PPPIOCATTCHAN(r8, 0x40047438, &(0x7f0000000340)=0x1) ioctl$PPPIOCSFLAGS1(r8, 0x40047459, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000240)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x1058, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000100)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x2f}, @flat=@weak_handle={0x77682a85, 0x100b, 0x1}, @fd={0x66642a85, 0x0, r3}}, &(0x7f0000000600)={0x0, 0x28, 0x40}}, 0x1000}], 0x0, 0x0, 0x0}) 342.245063ms ago: executing program 1 (id=3441): r0 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) symlink(&(0x7f0000000540)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000380)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') readlinkat(0xffffffffffffff9c, &(0x7f0000000100)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffffff, 0xb4) readlink(&(0x7f0000000280)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000480)=""/117, 0x75) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\'\x00\x00\x00\a'], 0x50) pwrite64(r1, &(0x7f0000000000)='2', 0x1, 0x7) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r2, &(0x7f0000000000), 0xd) 214.242677ms ago: executing program 2 (id=3781): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000680)=ANY=[@ANYBLOB="70010000100033060000000000000000fc0000000000000000000000000000007f000001000000000000000000000000dfff40004e2280010000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac14140b0000000000000000000000000000000032000000fe80000000000000000000000000000b2303000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffff7f00000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000029bd7000000000000a00000000000000000000004800020066707528706362632861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00200000004e1e00000000fc0200000000000000000000000000001c0004"], 0x170}}, 0x0) r1 = syz_io_uring_setup(0x3bd4, &(0x7f0000000180)={0x0, 0xcc19, 0x130c8, 0x6, 0x30e}, &(0x7f0000000100), &(0x7f0000000200), &(0x7f0000000000)) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000180)={0xffffffffffffffff}, 0x111, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r2, &(0x7f0000000640)={0x15, 0x110, 0xfa08, {r3, 0x0, 0x10, 0x10, 0x0, @in={0x2, 0x4, @loopback}, @in={0x2, 0x4e21, @remote}}}, 0x118) recvmsg$can_bcm(0xffffffffffffffff, 0x0, 0x10150) openat(0xffffffffffffff9c, 0x0, 0x2c040, 0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r1, 0x16, 0x0, 0x1) 0s ago: executing program 2 (id=3782): r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000040)={0x200000000000001}, 0x8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e2a, 0x79f0, @ipv4={'\x00', '\xff\xff', @remote}, 0x5}, 0x1a) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000001b40)) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) read$msr(0xffffffffffffffff, &(0x7f0000000280)=""/155, 0x9b) kernel console output (not intermixed with test programs): tor of length 216, skipping remainder of the config [ 849.647377][ T9] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 849.708505][ T9] usb 6-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 849.708542][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 849.708564][ T9] usb 6-1: Product: syz [ 849.708581][ T9] usb 6-1: Manufacturer: syz [ 849.708597][ T9] usb 6-1: SerialNumber: syz [ 850.246212][ T9] usb 6-1: USB disconnect, device number 45 [ 850.679074][T15808] FAULT_INJECTION: forcing a failure. [ 850.679074][T15808] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 850.679185][T15808] CPU: 1 UID: 0 PID: 15808 Comm: syz.2.3252 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 850.679218][T15808] Tainted: [L]=SOFTLOCKUP [ 850.679228][T15808] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 850.679241][T15808] Call Trace: [ 850.679251][T15808] [ 850.679261][T15808] dump_stack_lvl+0xe8/0x150 [ 850.679302][T15808] should_fail_ex+0x46b/0x600 [ 850.679340][T15808] _copy_to_user+0x31/0xb0 [ 850.679365][T15808] simple_read_from_buffer+0xe1/0x170 [ 850.679402][T15808] proc_fail_nth_read+0x1be/0x230 [ 850.679435][T15808] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 850.679467][T15808] ? rw_verify_area+0x2ac/0x4e0 [ 850.679501][T15808] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 850.679531][T15808] vfs_read+0x212/0xa80 [ 850.679567][T15808] ? preempt_schedule_thunk+0x16/0x30 [ 850.679597][T15808] ? __pfx_vfs_read+0x10/0x10 [ 850.679629][T15808] ? preempt_schedule_thunk+0x16/0x30 [ 850.679663][T15808] ? _raw_spin_unlock_irqrestore+0x74/0x80 [ 850.679689][T15808] ? mutex_lock_nested+0x152/0x1d0 [ 850.679717][T15808] ? fdget_pos+0x252/0x320 [ 850.679757][T15808] ksys_read+0x156/0x270 [ 850.679804][T15808] ? __pfx_ksys_read+0x10/0x10 [ 850.679852][T15808] do_syscall_64+0x14d/0xf80 [ 850.679877][T15808] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 850.679901][T15808] ? clear_bhb_loop+0x40/0x90 [ 850.679929][T15808] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 850.679952][T15808] RIP: 0033:0x7f66ae3fd04e [ 850.679975][T15808] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 850.679994][T15808] RSP: 002b:00007f66ac674fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 850.680020][T15808] RAX: ffffffffffffffda RBX: 00007f66ac6756c0 RCX: 00007f66ae3fd04e [ 850.680037][T15808] RDX: 000000000000000f RSI: 00007f66ac6750a0 RDI: 000000000000000a [ 850.680050][T15808] RBP: 00007f66ac675090 R08: 0000000000000000 R09: 0000000000000000 [ 850.680063][T15808] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 850.680076][T15808] R13: 00007f66ae6b6128 R14: 00007f66ae6b6090 R15: 00007fffeb0eacf8 [ 850.680113][T15808] [ 851.512708][T15814] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 851.512808][T15814] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 851.551372][T15814] vhci_hcd vhci_hcd.0: Device attached [ 852.130040][T15818] vhci_hcd: connection closed [ 852.278583][ T158] vhci_hcd vhci_hcd.1: stop threads [ 852.278629][ T158] vhci_hcd vhci_hcd.1: release socket [ 852.283366][ T158] vhci_hcd vhci_hcd.1: disconnect device [ 852.884398][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 852.884437][ C0] lec:lec_tx_timeout: lec0 [ 852.884546][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 853.195327][T15778] bridge_slave_0: left allmulticast mode [ 853.195351][T15778] bridge_slave_0: left promiscuous mode [ 853.195535][T15778] bridge0: port 1(bridge_slave_0) entered disabled state [ 853.698606][T15778] bridge_slave_1: left allmulticast mode [ 853.698629][T15778] bridge_slave_1: left promiscuous mode [ 853.698801][T15778] bridge0: port 2(bridge_slave_1) entered disabled state [ 853.910977][ T37] audit: type=1400 audit(1775126123.160:2405): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=1185 comm="irq/32-virtio1-" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=49592 netif=lo [ 854.029347][T15778] bond0: (slave bond_slave_0): Releasing backup interface [ 854.251276][T15778] bond0: (slave bond_slave_1): Releasing backup interface [ 854.429558][T15778] team0: Port device team_slave_0 removed [ 854.449120][T15868] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 854.449715][T15868] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 854.494374][ T5809] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 854.525720][T15778] team0: Port device team_slave_1 removed [ 854.641093][T15778] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 854.654406][ T5809] usb 4-1: Using ep0 maxpacket: 8 [ 854.664049][ T5809] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 854.664071][ T5809] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 854.664084][ T5809] usb 4-1: Product: syz [ 854.664093][ T5809] usb 4-1: Manufacturer: syz [ 854.664101][ T5809] usb 4-1: SerialNumber: syz [ 854.696346][ T5809] usb 4-1: config 0 descriptor?? [ 854.732729][T15778] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 854.764673][ T5887] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 855.099259][ T5809] dvb_usb_rtl28xxu 4-1:0.0: chip type detection failed -71 [ 855.099391][ T5809] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 855.101462][T15778] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 855.116779][T15778] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 855.134601][ T5809] usb 4-1: USB disconnect, device number 78 [ 855.154556][ T5887] usb 3-1: Using ep0 maxpacket: 8 [ 855.156885][ T5887] usb 3-1: config 162 has an invalid interface number: 84 but max is 2 [ 855.156913][ T5887] usb 3-1: config 162 has an invalid descriptor of length 0, skipping remainder of the config [ 855.156936][ T5887] usb 3-1: config 162 has 1 interface, different from the descriptor's value: 3 [ 855.156959][ T5887] usb 3-1: config 162 has no interface number 0 [ 855.157016][ T5887] usb 3-1: config 162 interface 84 altsetting 2 endpoint 0x9 has an invalid bInterval 127, changing to 10 [ 855.157044][ T5887] usb 3-1: config 162 interface 84 altsetting 2 endpoint 0x9 has invalid wMaxPacketSize 0 [ 855.157068][ T5887] usb 3-1: config 162 interface 84 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 855.157094][ T5887] usb 3-1: config 162 interface 84 has no altsetting 0 [ 855.160906][ T5887] usb 3-1: New USB device found, idVendor=0e8d, idProduct=763f, bcdDevice=9b.23 [ 855.161050][ T5887] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 855.161074][ T5887] usb 3-1: Product: syz [ 855.161090][ T5887] usb 3-1: Manufacturer: syz [ 855.161106][ T5887] usb 3-1: SerialNumber: syz [ 855.342572][T15778] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 855.556863][ T5887] usb 3-1: USB disconnect, device number 6 [ 856.524438][ T5887] usb 2-1: new full-speed USB device number 66 using dummy_hcd [ 856.684521][ T5887] usb 2-1: device descriptor read/64, error -71 [ 856.924338][ T5887] usb 2-1: new full-speed USB device number 67 using dummy_hcd [ 857.004454][T13173] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 857.154334][ T5887] usb 2-1: device descriptor read/64, error -71 [ 857.171490][T13173] usb 7-1: Using ep0 maxpacket: 16 [ 857.176150][T13173] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 857.176182][T13173] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 857.176204][T13173] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 857.176246][T13173] usb 7-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 857.176267][T13173] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 857.187301][T13173] usb 7-1: config 0 descriptor?? [ 857.264704][ T5887] usb usb2-port1: attempt power cycle [ 857.599310][T13173] shield 0003:0955:7214.0019: unknown main item tag 0x0 [ 857.599351][T13173] shield 0003:0955:7214.0019: unknown main item tag 0x0 [ 857.599380][T13173] shield 0003:0955:7214.0019: unknown main item tag 0x0 [ 857.599408][T13173] shield 0003:0955:7214.0019: unknown main item tag 0x0 [ 857.599434][T13173] shield 0003:0955:7214.0019: unknown main item tag 0x0 [ 857.624456][ T5887] usb 2-1: new full-speed USB device number 68 using dummy_hcd [ 857.661369][T13173] input: HID 0955:7214 Haptics as /devices/virtual/input/input27 [ 857.679243][ T5887] usb 2-1: device descriptor read/8, error -71 [ 857.793749][T15884] random: crng reseeded on system resumption [ 857.924388][ T5887] usb 2-1: new full-speed USB device number 69 using dummy_hcd [ 857.976898][ T5887] usb 2-1: device descriptor read/8, error -71 [ 858.068646][T13173] shield 0003:0955:7214.0019: Registered Thunderstrike controller [ 858.069114][T13173] shield 0003:0955:7214.0019: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.6-1/input0 [ 858.085935][ T5887] usb usb2-port1: unable to enumerate USB device [ 858.127370][ T5809] shield 0003:0955:7214.0019: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 858.127712][ T5809] shield 0003:0955:7214.0019: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 858.128052][ T5809] shield 0003:0955:7214.0019: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 858.128394][ T5809] shield 0003:0955:7214.0019: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 858.231645][T13173] usb 7-1: USB disconnect, device number 3 [ 859.024300][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 6140 ms [ 859.024339][ C0] lec:lec_tx_timeout: lec0 [ 859.024524][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 859.114449][T13173] usb 7-1: new full-speed USB device number 4 using dummy_hcd [ 859.286328][T13173] usb 7-1: unable to get BOS descriptor or descriptor too short [ 859.287168][T13173] usb 7-1: not running at top speed; connect to a high speed hub [ 859.288728][T13173] usb 7-1: config 1 has an invalid descriptor of length 81, skipping remainder of the config [ 859.288755][T13173] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 859.315457][T13173] usb 7-1: New USB device found, idVendor=09e8, idProduct=0021, bcdDevice= 0.40 [ 859.315489][T13173] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 859.315509][T13173] usb 7-1: Product: syz [ 859.315523][T13173] usb 7-1: Manufacturer: syz [ 859.315536][T13173] usb 7-1: SerialNumber: syz [ 859.714430][ T64] block nbd0: Possible stuck request ffff888025d0e000: control (read@0,1024B). Runtime 210 seconds [ 859.714481][ T64] block nbd0: Possible stuck request ffff888025d0e1c0: control (read@1024,1024B). Runtime 210 seconds [ 859.714514][ T64] block nbd0: Possible stuck request ffff888025d0e380: control (read@2048,1024B). Runtime 210 seconds [ 859.714544][ T64] block nbd0: Possible stuck request ffff888025d0e540: control (read@3072,1024B). Runtime 210 seconds [ 859.886535][T15928] netlink: 'syz.6.3286': attribute type 39 has an invalid length. [ 860.825489][T15936] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3299'. [ 860.831134][T15936] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3299'. [ 861.114449][T13173] usb 7-1: USB disconnect, device number 4 [ 861.214831][ T6492] udevd[6492]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 862.484539][ T5887] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 863.168339][ T5887] usb 7-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 863.168397][ T5887] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 863.168427][ T5887] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 863.168451][ T5887] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 863.170873][ T5887] usb 7-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 863.170907][ T5887] usb 7-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 863.170940][ T5887] usb 7-1: Manufacturer: syz [ 863.278431][ T5887] usb 7-1: config 0 descriptor?? [ 864.075820][ T5887] appleir 0003:05AC:8243.001A: unknown main item tag 0x0 [ 864.110081][ T5887] appleir 0003:05AC:8243.001A: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.6-1/input0 [ 864.295816][T13173] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 864.384962][ T5809] usb 7-1: USB disconnect, device number 5 [ 864.474367][T13173] usb 6-1: Using ep0 maxpacket: 16 [ 864.476742][T13173] usb 6-1: config 0 interface 0 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 25 [ 864.476780][T13173] usb 6-1: config 0 interface 0 has no altsetting 0 [ 864.476818][T13173] usb 6-1: New USB device found, idVendor=146b, idProduct=0902, bcdDevice= 0.00 [ 864.476843][T13173] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 864.516326][T13173] usb 6-1: config 0 descriptor?? [ 864.793095][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5760 ms [ 864.793131][ C0] lec:lec_tx_timeout: lec0 [ 864.793338][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 864.828410][T15988] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3319'. [ 864.864759][T15982] fido_id[15982]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/report_descriptor': No such file or directory [ 864.921668][T13173] hid (null): invalid report_size 29797 [ 864.921714][T13173] hid (null): invalid report_size 29696 [ 864.971206][T13173] bigben 0003:146B:0902.001B: unexpected rdesc, please submit for review [ 864.971586][T13173] bigben 0003:146B:0902.001B: unknown main item tag 0x0 [ 864.971606][T13173] bigben 0003:146B:0902.001B: unknown main item tag 0x0 [ 864.971621][T13173] bigben 0003:146B:0902.001B: unknown main item tag 0x0 [ 864.971643][T13173] bigben 0003:146B:0902.001B: unknown main item tag 0x0 [ 864.971658][T13173] bigben 0003:146B:0902.001B: unknown main item tag 0x0 [ 864.971673][T13173] bigben 0003:146B:0902.001B: unknown main item tag 0x0 [ 864.971687][T13173] bigben 0003:146B:0902.001B: unknown main item tag 0x0 [ 864.971703][T13173] bigben 0003:146B:0902.001B: invalid report_size 29797 [ 864.971712][T13173] bigben 0003:146B:0902.001B: item 0 2 1 7 parsing failed [ 864.972194][T13173] bigben 0003:146B:0902.001B: parse failed [ 864.972258][T13173] bigben 0003:146B:0902.001B: probe with driver bigben failed with error -22 [ 865.137622][ T5809] usb 6-1: USB disconnect, device number 46 [ 865.287454][T16001] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3327'. [ 865.288691][T16001] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3327'. [ 868.539595][T16042] FAULT_INJECTION: forcing a failure. [ 868.539595][T16042] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 868.539646][T16042] CPU: 1 UID: 0 PID: 16042 Comm: syz.2.3341 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 868.539676][T16042] Tainted: [L]=SOFTLOCKUP [ 868.539683][T16042] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 868.539697][T16042] Call Trace: [ 868.539706][T16042] [ 868.539716][T16042] dump_stack_lvl+0xe8/0x150 [ 868.539754][T16042] should_fail_ex+0x46b/0x600 [ 868.539788][T16042] _copy_to_user+0x31/0xb0 [ 868.539814][T16042] simple_read_from_buffer+0xe1/0x170 [ 868.539848][T16042] proc_fail_nth_read+0x1be/0x230 [ 868.539878][T16042] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 868.539910][T16042] ? rw_verify_area+0x2ac/0x4e0 [ 868.539941][T16042] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 868.539970][T16042] vfs_read+0x212/0xa80 [ 868.540013][T16042] ? __pfx_vfs_read+0x10/0x10 [ 868.540046][T16042] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 868.540072][T16042] ? lockdep_hardirqs_on+0x7a/0x110 [ 868.540097][T16042] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 868.540120][T16042] ? mutex_lock_nested+0x152/0x1d0 [ 868.540148][T16042] ? fdget_pos+0x252/0x320 [ 868.540188][T16042] ksys_read+0x156/0x270 [ 868.540224][T16042] ? __pfx_ksys_read+0x10/0x10 [ 868.540256][T16042] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 868.540291][T16042] do_syscall_64+0x14d/0xf80 [ 868.540314][T16042] ? trace_irq_disable+0x3b/0x150 [ 868.540341][T16042] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 868.540364][T16042] ? clear_bhb_loop+0x40/0x90 [ 868.540392][T16042] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 868.540413][T16042] RIP: 0033:0x7f66ae3fd04e [ 868.540435][T16042] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 868.540454][T16042] RSP: 002b:00007f66ac695fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 868.540479][T16042] RAX: ffffffffffffffda RBX: 00007f66ac6966c0 RCX: 00007f66ae3fd04e [ 868.540495][T16042] RDX: 000000000000000f RSI: 00007f66ac6960a0 RDI: 0000000000000004 [ 868.540510][T16042] RBP: 00007f66ac696090 R08: 0000000000000000 R09: 0000000000000000 [ 868.540524][T16042] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 868.540537][T16042] R13: 00007f66ae6b6038 R14: 00007f66ae6b5fa0 R15: 00007fffeb0eacf8 [ 868.540573][T16042] [ 869.794292][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 869.794329][ C0] lec:lec_tx_timeout: lec0 [ 869.794421][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 869.915139][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.053997][T16055] tipc: Failed to remove unknown binding: 66,0,0/0:187433036/187433038 [ 870.054041][T16055] tipc: Failed to remove unknown binding: 66,0,0/0:187433036/187433037 [ 870.081354][T16055] tipc: Failed to remove unknown binding: 66,0,0/0:187433036/187433038 [ 870.081398][T16055] tipc: Failed to remove unknown binding: 66,0,0/0:187433036/187433037 [ 870.324603][ T5809] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 870.494457][ T5809] usb 7-1: Using ep0 maxpacket: 16 [ 870.515232][ T5809] usb 7-1: config 0 interface 0 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 25 [ 870.515266][ T5809] usb 7-1: config 0 interface 0 has no altsetting 0 [ 870.515301][ T5809] usb 7-1: New USB device found, idVendor=146b, idProduct=0902, bcdDevice= 0.00 [ 870.515323][ T5809] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 870.526523][ T5809] usb 7-1: config 0 descriptor?? [ 870.933613][ T5809] hid (null): invalid report_size 29797 [ 870.933643][ T5809] hid (null): invalid report_size 29696 [ 870.953164][ T5809] bigben 0003:146B:0902.001C: unexpected rdesc, please submit for review [ 870.953548][ T5809] bigben 0003:146B:0902.001C: unknown main item tag 0x0 [ 870.953570][ T5809] bigben 0003:146B:0902.001C: unknown main item tag 0x0 [ 870.953586][ T5809] bigben 0003:146B:0902.001C: unknown main item tag 0x0 [ 870.953601][ T5809] bigben 0003:146B:0902.001C: unknown main item tag 0x0 [ 870.953616][ T5809] bigben 0003:146B:0902.001C: unknown main item tag 0x0 [ 870.953631][ T5809] bigben 0003:146B:0902.001C: unknown main item tag 0x0 [ 870.953646][ T5809] bigben 0003:146B:0902.001C: unknown main item tag 0x0 [ 870.953661][ T5809] bigben 0003:146B:0902.001C: invalid report_size 29797 [ 870.953672][ T5809] bigben 0003:146B:0902.001C: item 0 2 1 7 parsing failed [ 870.954152][ T5809] bigben 0003:146B:0902.001C: parse failed [ 870.968537][ T5809] bigben 0003:146B:0902.001C: probe with driver bigben failed with error -22 [ 871.138768][ T5913] usb 7-1: USB disconnect, device number 6 [ 871.483138][T16075] FAULT_INJECTION: forcing a failure. [ 871.483138][T16075] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 871.483167][T16075] CPU: 0 UID: 0 PID: 16075 Comm: syz.2.3352 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 871.483185][T16075] Tainted: [L]=SOFTLOCKUP [ 871.483190][T16075] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 871.483198][T16075] Call Trace: [ 871.483203][T16075] [ 871.483209][T16075] dump_stack_lvl+0xe8/0x150 [ 871.483233][T16075] should_fail_ex+0x46b/0x600 [ 871.483253][T16075] _copy_from_user+0x2d/0xb0 [ 871.483267][T16075] memdup_user+0x5e/0xd0 [ 871.483284][T16075] strndup_user+0x68/0xd0 [ 871.483301][T16075] __se_sys_request_key+0x18b/0x350 [ 871.483316][T16075] ? __pfx___se_sys_request_key+0x10/0x10 [ 871.483337][T16075] do_syscall_64+0x14d/0xf80 [ 871.483350][T16075] ? trace_irq_disable+0x3b/0x150 [ 871.483365][T16075] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 871.483378][T16075] ? clear_bhb_loop+0x40/0x90 [ 871.483393][T16075] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 871.483405][T16075] RIP: 0033:0x7f66ae43c819 [ 871.483418][T16075] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 871.483429][T16075] RSP: 002b:00007f66ac654028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f9 [ 871.483444][T16075] RAX: ffffffffffffffda RBX: 00007f66ae6b6180 RCX: 00007f66ae43c819 [ 871.483453][T16075] RDX: 0000200000000340 RSI: 0000200000000280 RDI: 0000200000000100 [ 871.483462][T16075] RBP: 00007f66ac654090 R08: 0000000000000000 R09: 0000000000000000 [ 871.483469][T16075] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000001 [ 871.483477][T16075] R13: 00007f66ae6b6218 R14: 00007f66ae6b6180 R15: 00007fffeb0eacf8 [ 871.483495][T16075] [ 872.093983][T16086] loop7: detected capacity change from 0 to 7 [ 872.596536][T16086] Dev loop7: unable to read RDB block 7 [ 872.596599][T16086] loop7: unable to read partition table [ 872.596847][T16086] loop7: partition table beyond EOD, truncated [ 872.596891][T16086] loop_reread_partitions: partition scan of loop7 (úùƒå¡™‰ü¾CêjÌ–ã¢P=ý?ã}X‹ºÐ œëÜ%õ«`ÉæÖs­±„۷֘ȵ4âåQkÝŠ) failed (rc=-5) [ 872.883909][T16095] fuse: Unknown parameter 'af°€ý¶hñC°ŽLlzb¶¼Ïfé€M‡|óÛ!”û' [ 872.943209][T16095] afs: Unknown parameter 'uid<00000000000000000000' [ 874.804299][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 874.804334][ C0] lec:lec_tx_timeout: lec0 [ 874.804423][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 875.475111][T16125] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3371'. [ 875.714350][ T5913] usb 2-1: new full-speed USB device number 70 using dummy_hcd [ 875.856641][ T5913] usb 2-1: device descriptor read/64, error -71 [ 876.094487][ T5913] usb 2-1: new full-speed USB device number 71 using dummy_hcd [ 876.224420][ T5913] usb 2-1: device descriptor read/64, error -71 [ 876.334980][ T5913] usb usb2-port1: attempt power cycle [ 876.665745][T16147] binder: BINDER_SET_CONTEXT_MGR already set [ 876.665763][T16147] binder: 16146:16147 ioctl 4018620d 200000004a80 returned -16 [ 876.764369][ T5913] usb 2-1: new full-speed USB device number 72 using dummy_hcd [ 876.795217][ T5913] usb 2-1: device descriptor read/8, error -71 [ 877.034509][ T5913] usb 2-1: new full-speed USB device number 73 using dummy_hcd [ 877.065747][ T5913] usb 2-1: device descriptor read/8, error -71 [ 877.175860][ T5913] usb usb2-port1: unable to enumerate USB device [ 878.496600][T16165] FAULT_INJECTION: forcing a failure. [ 878.496600][T16165] name failslab, interval 1, probability 0, space 0, times 0 [ 878.496637][T16165] CPU: 0 UID: 0 PID: 16165 Comm: syz.2.3387 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 878.496663][T16165] Tainted: [L]=SOFTLOCKUP [ 878.496670][T16165] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 878.496680][T16165] Call Trace: [ 878.496688][T16165] [ 878.496696][T16165] dump_stack_lvl+0xe8/0x150 [ 878.496730][T16165] should_fail_ex+0x46b/0x600 [ 878.496771][T16165] should_failslab+0xa8/0x100 [ 878.496793][T16165] kmem_cache_alloc_node_noprof+0x8f/0x6e0 [ 878.496824][T16165] ? __alloc_skb+0x1d0/0x7d0 [ 878.496839][T16165] ? lockdep_hardirqs_on+0x7a/0x110 [ 878.496862][T16165] __alloc_skb+0x1d0/0x7d0 [ 878.496884][T16165] netlink_sendmsg+0x5d4/0xb40 [ 878.496922][T16165] ? __pfx_netlink_sendmsg+0x10/0x10 [ 878.496948][T16165] ? unwind_get_return_address+0x4d/0x90 [ 878.496970][T16165] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 878.496999][T16165] ____sys_sendmsg+0x94c/0x9c0 [ 878.497025][T16165] ? __pfx_____sys_sendmsg+0x10/0x10 [ 878.497053][T16165] ? import_iovec+0x73/0xa0 [ 878.497083][T16165] ___sys_sendmsg+0x2a5/0x360 [ 878.497108][T16165] ? __pfx____sys_sendmsg+0x10/0x10 [ 878.497162][T16165] ? __fget_files+0x2a/0x420 [ 878.497184][T16165] ? __fget_files+0x3a6/0x420 [ 878.497216][T16165] __x64_sys_sendmsg+0x1c3/0x2a0 [ 878.497240][T16165] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 878.497271][T16165] ? __pfx_ksys_write+0x10/0x10 [ 878.497310][T16165] do_syscall_64+0x14d/0xf80 [ 878.497347][T16165] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 878.497365][T16165] ? clear_bhb_loop+0x40/0x90 [ 878.497386][T16165] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 878.497402][T16165] RIP: 0033:0x7f66ae43c819 [ 878.497420][T16165] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 878.497435][T16165] RSP: 002b:00007f66ac675028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 878.497455][T16165] RAX: ffffffffffffffda RBX: 00007f66ae6b6090 RCX: 00007f66ae43c819 [ 878.497468][T16165] RDX: 0000000000040800 RSI: 00002000000006c0 RDI: 0000000000000005 [ 878.497479][T16165] RBP: 00007f66ac675090 R08: 0000000000000000 R09: 0000000000000000 [ 878.497490][T16165] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 878.497501][T16165] R13: 00007f66ae6b6128 R14: 00007f66ae6b6090 R15: 00007fffeb0eacf8 [ 878.497530][T16165] [ 879.714625][ T5913] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 879.814291][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 879.814325][ C0] lec:lec_tx_timeout: lec0 [ 879.814420][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 879.867043][ T5913] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 879.867081][ T5913] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 879.867124][ T5913] usb 2-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 879.867150][ T5913] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 879.924789][ T5913] usb 2-1: config 0 descriptor?? [ 880.060393][T16193] FAULT_INJECTION: forcing a failure. [ 880.060393][T16193] name failslab, interval 1, probability 0, space 0, times 0 [ 880.060436][T16193] CPU: 0 UID: 0 PID: 16193 Comm: syz.2.3399 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 880.060466][T16193] Tainted: [L]=SOFTLOCKUP [ 880.060475][T16193] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 880.060489][T16193] Call Trace: [ 880.060503][T16193] [ 880.060513][T16193] dump_stack_lvl+0xe8/0x150 [ 880.060553][T16193] should_fail_ex+0x46b/0x600 [ 880.060590][T16193] should_failslab+0xa8/0x100 [ 880.060616][T16193] __kmalloc_noprof+0xdf/0x7b0 [ 880.060639][T16193] ? tomoyo_encode+0x28b/0x550 [ 880.060674][T16193] tomoyo_encode+0x28b/0x550 [ 880.060709][T16193] tomoyo_realpath_from_path+0x58d/0x5d0 [ 880.060759][T16193] ? tomoyo_path_number_perm+0x219/0x630 [ 880.060784][T16193] tomoyo_path_number_perm+0x246/0x630 [ 880.060811][T16193] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 880.060839][T16193] ? __lock_acquire+0x6b5/0x2cf0 [ 880.060902][T16193] ? __fget_files+0x2a/0x420 [ 880.060936][T16193] ? __fget_files+0x2a/0x420 [ 880.060964][T16193] ? __fget_files+0x3a6/0x420 [ 880.060991][T16193] ? __fget_files+0x2a/0x420 [ 880.061025][T16193] security_file_ioctl+0xc3/0x2a0 [ 880.061053][T16193] __se_sys_ioctl+0x47/0x170 [ 880.061079][T16193] do_syscall_64+0x14d/0xf80 [ 880.061104][T16193] ? trace_irq_disable+0x3b/0x150 [ 880.061130][T16193] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 880.061153][T16193] ? clear_bhb_loop+0x40/0x90 [ 880.061181][T16193] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 880.061202][T16193] RIP: 0033:0x7f66ae43c819 [ 880.061224][T16193] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 880.061242][T16193] RSP: 002b:00007f66ac696028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 880.061268][T16193] RAX: ffffffffffffffda RBX: 00007f66ae6b5fa0 RCX: 00007f66ae43c819 [ 880.061284][T16193] RDX: 00002000000001c0 RSI: 00000000c0303e03 RDI: 0000000000000006 [ 880.061299][T16193] RBP: 00007f66ac696090 R08: 0000000000000000 R09: 0000000000000000 [ 880.061312][T16193] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 880.061326][T16193] R13: 00007f66ae6b6038 R14: 00007f66ae6b5fa0 R15: 00007fffeb0eacf8 [ 880.061363][T16193] [ 880.061479][T16193] ERROR: Out of memory at tomoyo_realpath_from_path. [ 880.147019][ T37] audit: type=1400 audit(1775126149.400:2406): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=16 comm="ktimers/0" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=60496 netif=lo [ 880.739839][T16198] FAULT_INJECTION: forcing a failure. [ 880.739839][T16198] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 880.739911][T16198] CPU: 0 UID: 0 PID: 16198 Comm: syz.3.3400 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 880.739943][T16198] Tainted: [L]=SOFTLOCKUP [ 880.739951][T16198] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 880.739965][T16198] Call Trace: [ 880.739974][T16198] [ 880.739984][T16198] dump_stack_lvl+0xe8/0x150 [ 880.740026][T16198] should_fail_ex+0x46b/0x600 [ 880.740063][T16198] _copy_to_user+0x31/0xb0 [ 880.740088][T16198] simple_read_from_buffer+0xe1/0x170 [ 880.740124][T16198] proc_fail_nth_read+0x1be/0x230 [ 880.740157][T16198] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 880.740190][T16198] ? rw_verify_area+0x2ac/0x4e0 [ 880.740223][T16198] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 880.740253][T16198] vfs_read+0x212/0xa80 [ 880.740291][T16198] ? preempt_schedule_thunk+0x16/0x30 [ 880.740321][T16198] ? __pfx_vfs_read+0x10/0x10 [ 880.740352][T16198] ? preempt_schedule_thunk+0x16/0x30 [ 880.740386][T16198] ? _raw_spin_unlock_irqrestore+0x74/0x80 [ 880.740412][T16198] ? mutex_lock_nested+0x152/0x1d0 [ 880.740443][T16198] ? fdget_pos+0x252/0x320 [ 880.740483][T16198] ksys_read+0x156/0x270 [ 880.740520][T16198] ? __pfx_ksys_read+0x10/0x10 [ 880.740566][T16198] do_syscall_64+0x14d/0xf80 [ 880.740591][T16198] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 880.740614][T16198] ? clear_bhb_loop+0x40/0x90 [ 880.740642][T16198] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 880.740665][T16198] RIP: 0033:0x7f081b2dd04e [ 880.740687][T16198] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 880.740706][T16198] RSP: 002b:00007f0819533fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 880.740730][T16198] RAX: ffffffffffffffda RBX: 00007f08195346c0 RCX: 00007f081b2dd04e [ 880.740748][T16198] RDX: 000000000000000f RSI: 00007f08195340a0 RDI: 0000000000000009 [ 880.740763][T16198] RBP: 00007f0819534090 R08: 0000000000000000 R09: 0000000000000000 [ 880.740778][T16198] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 880.740801][T16198] R13: 00007f081b596218 R14: 00007f081b596180 R15: 00007ffdeb87b3e8 [ 880.740838][T16198] [ 881.023312][ T5913] playstation 0003:054C:0DF2.001D: unknown main item tag 0x0 [ 881.023350][ T5913] playstation 0003:054C:0DF2.001D: unknown main item tag 0x0 [ 881.023378][ T5913] playstation 0003:054C:0DF2.001D: unknown main item tag 0x0 [ 881.023405][ T5913] playstation 0003:054C:0DF2.001D: unknown main item tag 0x0 [ 881.023432][ T5913] playstation 0003:054C:0DF2.001D: unknown main item tag 0x0 [ 881.081135][ T5913] playstation 0003:054C:0DF2.001D: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.1-1/input0 [ 881.140637][ T5913] playstation 0003:054C:0DF2.001D: Invalid byte count transferred, expected 20 got 0 [ 881.140669][ T5913] playstation 0003:054C:0DF2.001D: Failed to retrieve DualSense pairing info: -22 [ 881.140736][ T5913] playstation 0003:054C:0DF2.001D: Failed to get MAC address from DualSense [ 881.140753][ T5913] playstation 0003:054C:0DF2.001D: Failed to create dualsense. [ 881.235384][ T5913] playstation 0003:054C:0DF2.001D: probe with driver playstation failed with error -22 [ 881.263250][T16202] FAULT_INJECTION: forcing a failure. [ 881.263250][T16202] name failslab, interval 1, probability 0, space 0, times 0 [ 881.263291][T16202] CPU: 1 UID: 0 PID: 16202 Comm: syz.5.3401 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 881.263321][T16202] Tainted: [L]=SOFTLOCKUP [ 881.263330][T16202] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 881.263345][T16202] Call Trace: [ 881.263354][T16202] [ 881.263364][T16202] dump_stack_lvl+0xe8/0x150 [ 881.263404][T16202] should_fail_ex+0x46b/0x600 [ 881.263442][T16202] should_failslab+0xa8/0x100 [ 881.263478][T16202] __kmalloc_noprof+0xdf/0x7b0 [ 881.263498][T16202] ? kfree+0x4d/0x6c0 [ 881.263528][T16202] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 881.263564][T16202] tomoyo_realpath_from_path+0xe3/0x5d0 [ 881.263604][T16202] ? tomoyo_path_number_perm+0x219/0x630 [ 881.263630][T16202] tomoyo_path_number_perm+0x246/0x630 [ 881.263657][T16202] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 881.263683][T16202] ? __lock_acquire+0x6b5/0x2cf0 [ 881.263745][T16202] ? __fget_files+0x2a/0x420 [ 881.263778][T16202] ? __fget_files+0x2a/0x420 [ 881.263806][T16202] ? __fget_files+0x3a6/0x420 [ 881.263832][T16202] ? __fget_files+0x2a/0x420 [ 881.263866][T16202] security_file_ioctl+0xc3/0x2a0 [ 881.263895][T16202] __se_sys_ioctl+0x47/0x170 [ 881.263919][T16202] do_syscall_64+0x14d/0xf80 [ 881.263944][T16202] ? trace_irq_disable+0x3b/0x150 [ 881.263971][T16202] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 881.263994][T16202] ? clear_bhb_loop+0x40/0x90 [ 881.264022][T16202] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 881.264043][T16202] RIP: 0033:0x7fcda5ebc819 [ 881.264063][T16202] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 881.264082][T16202] RSP: 002b:00007fcda410e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 881.264106][T16202] RAX: ffffffffffffffda RBX: 00007fcda6135fa0 RCX: 00007fcda5ebc819 [ 881.264123][T16202] RDX: 0000200000000040 RSI: 00000000c008ae88 RDI: 0000000000000003 [ 881.264139][T16202] RBP: 00007fcda410e090 R08: 0000000000000000 R09: 0000000000000000 [ 881.264153][T16202] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 881.264167][T16202] R13: 00007fcda6136038 R14: 00007fcda6135fa0 R15: 00007fff9a758018 [ 881.264208][T16202] [ 881.288534][T16202] ERROR: Out of memory at tomoyo_realpath_from_path. [ 881.549480][ T37] audit: type=1326 audit(1775126150.800:2407): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16203 comm="syz.3.3404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f081b31c819 code=0x7ffc0000 [ 881.561067][ T37] audit: type=1326 audit(1775126150.810:2408): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16203 comm="syz.3.3404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f081b31c819 code=0x7ffc0000 [ 881.564366][ T37] audit: type=1326 audit(1775126150.810:2409): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16203 comm="syz.3.3404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f081b31c819 code=0x7ffc0000 [ 881.785825][ T37] audit: type=1326 audit(1775126151.040:2410): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16203 comm="syz.3.3404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f081b31c819 code=0x7ffc0000 [ 881.786224][ T37] audit: type=1326 audit(1775126151.040:2411): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16203 comm="syz.3.3404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f081b31c819 code=0x7ffc0000 [ 881.786381][ T37] audit: type=1326 audit(1775126151.040:2412): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16203 comm="syz.3.3404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f081b31c819 code=0x7ffc0000 [ 881.824378][T16207] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 881.824951][T16207] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 881.860150][ T37] audit: type=1326 audit(1775126151.110:2413): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16203 comm="syz.3.3404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f081b31c819 code=0x7ffc0000 [ 881.860213][ T37] audit: type=1326 audit(1775126151.110:2414): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16203 comm="syz.3.3404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f081b31c819 code=0x7ffc0000 [ 881.860260][ T37] audit: type=1326 audit(1775126151.110:2416): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16203 comm="syz.3.3404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f081b31c819 code=0x7ffc0000 [ 882.119071][T16210] binder: BINDER_SET_CONTEXT_MGR already set [ 882.119090][T16210] binder: 16209:16210 ioctl 4018620d 200000004a80 returned -16 [ 882.586654][T16219] netlink: 16186 bytes leftover after parsing attributes in process `syz.5.3409'. [ 882.682980][T16219] netlink: 'syz.5.3409': attribute type 10 has an invalid length. [ 883.088048][ T5913] usb 2-1: USB disconnect, device number 74 [ 883.102282][T16228] netlink: 'syz.5.3412': attribute type 9 has an invalid length. [ 883.102310][T16228] netlink: 'syz.5.3412': attribute type 11 has an invalid length. [ 883.102327][T16228] netlink: 'syz.5.3412': attribute type 12 has an invalid length. [ 883.102348][T16228] netlink: 210020 bytes leftover after parsing attributes in process `syz.5.3412'. [ 883.102573][T16228] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3412'. [ 883.844457][ T5913] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 883.996660][ T5913] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 883.996698][ T5913] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 883.996750][ T5913] usb 4-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 883.996775][ T5913] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 884.046443][ T5913] usb 4-1: config 0 descriptor?? [ 884.333617][T16260] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3426'. [ 884.656067][ T5913] playstation 0003:054C:0DF2.001E: unknown main item tag 0x0 [ 884.656108][ T5913] playstation 0003:054C:0DF2.001E: unknown main item tag 0x0 [ 884.656135][ T5913] playstation 0003:054C:0DF2.001E: unknown main item tag 0x0 [ 884.656162][ T5913] playstation 0003:054C:0DF2.001E: unknown main item tag 0x0 [ 884.656187][ T5913] playstation 0003:054C:0DF2.001E: unknown main item tag 0x0 [ 884.827438][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 884.827530][ C0] lec:lec_tx_timeout: lec0 [ 884.842151][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 885.664666][T13173] usb 2-1: new full-speed USB device number 75 using dummy_hcd [ 885.726592][ T5913] playstation 0003:054C:0DF2.001E: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.3-1/input0 [ 885.785035][ T5913] playstation 0003:054C:0DF2.001E: Failed to retrieve feature with reportID 9: -71 [ 885.785070][ T5913] playstation 0003:054C:0DF2.001E: Failed to retrieve DualSense pairing info: -71 [ 885.785131][ T5913] playstation 0003:054C:0DF2.001E: Failed to get MAC address from DualSense [ 885.785148][ T5913] playstation 0003:054C:0DF2.001E: Failed to create dualsense. [ 885.788473][ T5913] playstation 0003:054C:0DF2.001E: probe with driver playstation failed with error -71 [ 885.793991][ T5913] usb 4-1: USB disconnect, device number 79 [ 885.839965][T13173] usb 2-1: config 36 has an invalid descriptor of length 0, skipping remainder of the config [ 885.840021][T13173] usb 2-1: config 36 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 885.846322][T13173] usb 2-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 885.846354][T13173] usb 2-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 885.846374][T13173] usb 2-1: Manufacturer: syz [ 885.846389][T13173] usb 2-1: SerialNumber: syz [ 885.914423][ T37] kauditd_printk_skb: 13 callbacks suppressed [ 885.914446][ T37] audit: type=1400 audit(1775126155.160:2429): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41306 netif=lo [ 886.198164][T16269] fido_id[16269]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/4-1/report_descriptor': No such file or directory [ 886.453056][T13173] usbhid 2-1:36.0: couldn't find an input interrupt endpoint [ 886.464541][ T9] usb 6-1: new full-speed USB device number 47 using dummy_hcd [ 886.482903][T13173] usb 2-1: USB disconnect, device number 75 [ 886.544927][ T5913] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 886.629706][ T9] usb 6-1: unable to get BOS descriptor or descriptor too short [ 886.630341][ T9] usb 6-1: not running at top speed; connect to a high speed hub [ 886.632099][ T9] usb 6-1: config 1 has an invalid descriptor of length 81, skipping remainder of the config [ 886.632125][ T9] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 886.674035][ T9] usb 6-1: New USB device found, idVendor=09e8, idProduct=0021, bcdDevice= 0.40 [ 886.674061][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 886.674074][ T9] usb 6-1: Product: syz [ 886.674083][ T9] usb 6-1: Manufacturer: syz [ 886.674091][ T9] usb 6-1: SerialNumber: syz [ 886.720569][ T5913] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 886.720676][ T5913] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 886.720723][ T5913] usb 4-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 886.720748][ T5913] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 886.750166][ T5913] usb 4-1: config 0 descriptor?? [ 887.035603][T16276] netlink: 'syz.5.3432': attribute type 39 has an invalid length. [ 887.090286][ T37] audit: type=1400 audit(1775126156.340:2430): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=16275 comm="syz.5.3432" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=35022 netif=lo [ 887.090348][ T37] audit: type=1400 audit(1775126156.340:2431): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=16275 comm="syz.5.3432" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=35022 netif=lo [ 887.090398][ T37] audit: type=1400 audit(1775126156.340:2432): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=16275 comm="syz.5.3432" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=35022 netif=lo [ 887.090445][ T37] audit: type=1400 audit(1775126156.340:2433): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=16275 comm="syz.5.3432" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=35022 netif=lo [ 887.090503][ T37] audit: type=1400 audit(1775126156.340:2434): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=16275 comm="syz.5.3432" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=35022 netif=lo [ 887.090548][ T37] audit: type=1400 audit(1775126156.340:2435): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=16275 comm="syz.5.3432" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=35022 netif=lo [ 887.090594][ T37] audit: type=1400 audit(1775126156.340:2436): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=16275 comm="syz.5.3432" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=35022 netif=lo [ 887.090641][ T37] audit: type=1400 audit(1775126156.340:2437): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=16275 comm="syz.5.3432" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=35022 netif=lo [ 887.195532][ T37] audit: type=1400 audit(1775126156.450:2438): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=16 comm="ktimers/0" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=49592 netif=lo [ 887.302999][ T5913] playstation 0003:054C:0DF2.001F: unknown main item tag 0x0 [ 887.303042][ T5913] playstation 0003:054C:0DF2.001F: unknown main item tag 0x0 [ 887.303781][ T5913] playstation 0003:054C:0DF2.001F: unknown main item tag 0x0 [ 887.303808][ T5913] playstation 0003:054C:0DF2.001F: unknown main item tag 0x0 [ 887.303833][ T5913] playstation 0003:054C:0DF2.001F: unknown main item tag 0x0 [ 887.343958][ T5913] playstation 0003:054C:0DF2.001F: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.3-1/input0 [ 887.416490][ T5913] playstation 0003:054C:0DF2.001F: Invalid byte count transferred, expected 20 got 0 [ 887.416513][ T5913] playstation 0003:054C:0DF2.001F: Failed to retrieve DualSense pairing info: -22 [ 887.416584][ T5913] playstation 0003:054C:0DF2.001F: Failed to get MAC address from DualSense [ 887.416594][ T5913] playstation 0003:054C:0DF2.001F: Failed to create dualsense. [ 887.451609][ T5913] playstation 0003:054C:0DF2.001F: probe with driver playstation failed with error -22 [ 887.597148][T16293] netlink: 'syz.2.3440': attribute type 9 has an invalid length. [ 887.801288][ T9] usb 6-1: USB disconnect, device number 47 [ 887.971678][ T6036] udevd[6036]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 888.245837][ T5887] usb 4-1: USB disconnect, device number 80 [ 888.741062][ T5813] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 888.763896][ T5813] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 888.770969][ T5813] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 888.778591][ T5813] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 888.779353][ T5813] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 888.796346][T13173] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 888.974402][T13173] usb 6-1: Using ep0 maxpacket: 8 [ 888.977601][T13173] usb 6-1: unable to get BOS descriptor or descriptor too short [ 888.979211][T13173] usb 6-1: config 1 interface 0 altsetting 255 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 888.979246][T13173] usb 6-1: config 1 interface 0 altsetting 255 endpoint 0x81 has invalid wMaxPacketSize 0 [ 888.979273][T13173] usb 6-1: config 1 interface 0 has no altsetting 0 [ 889.043749][T13173] usb 6-1: New USB device found, idVendor=0c45, idProduct=760b, bcdDevice= 0.40 [ 889.043784][T13173] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 889.043807][T13173] usb 6-1: Product: syz [ 889.043823][T13173] usb 6-1: Manufacturer: syz [ 889.043840][T13173] usb 6-1: SerialNumber: syz [ 889.197349][T16307] virt_wifi0 speed is unknown, defaulting to 1000 [ 889.443575][ T5813] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 889.461176][ T5813] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 889.462977][ T5813] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 889.466160][ T5813] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 889.466932][ T5813] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 889.543298][T16316] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3443'. [ 889.576368][T16303] tc_dump_action: action bad kind [ 889.637429][T16318] FAULT_INJECTION: forcing a failure. [ 889.637429][T16318] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 889.637470][T16318] CPU: 0 UID: 0 PID: 16318 Comm: syz.3.3448 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 889.637500][T16318] Tainted: [L]=SOFTLOCKUP [ 889.637508][T16318] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 889.637520][T16318] Call Trace: [ 889.637529][T16318] [ 889.637538][T16318] dump_stack_lvl+0xe8/0x150 [ 889.637577][T16318] should_fail_ex+0x46b/0x600 [ 889.637614][T16318] _copy_from_user+0x2d/0xb0 [ 889.637636][T16318] vhost_net_ioctl+0x1c1/0x17d0 [ 889.637684][T16318] ? smack_file_ioctl+0x263/0x360 [ 889.637721][T16318] ? __pfx_vhost_net_ioctl+0x10/0x10 [ 889.637767][T16318] ? __fget_files+0x2a/0x420 [ 889.637794][T16318] ? __fget_files+0x3a6/0x420 [ 889.637819][T16318] ? __fget_files+0x2a/0x420 [ 889.637850][T16318] ? bpf_lsm_file_ioctl+0x9/0x20 [ 889.637873][T16318] ? __pfx_vhost_net_ioctl+0x10/0x10 [ 889.637903][T16318] __se_sys_ioctl+0xff/0x170 [ 889.637929][T16318] do_syscall_64+0x14d/0xf80 [ 889.637952][T16318] ? trace_irq_disable+0x3b/0x150 [ 889.637976][T16318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 889.637999][T16318] ? clear_bhb_loop+0x40/0x90 [ 889.638026][T16318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 889.638048][T16318] RIP: 0033:0x7f081b31c819 [ 889.638069][T16318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 889.638088][T16318] RSP: 002b:00007f0819576028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 889.638114][T16318] RAX: ffffffffffffffda RBX: 00007f081b595fa0 RCX: 00007f081b31c819 [ 889.638130][T16318] RDX: 00002000000003c0 RSI: 000000004008af30 RDI: 0000000000000005 [ 889.638143][T16318] RBP: 00007f0819576090 R08: 0000000000000000 R09: 0000000000000000 [ 889.638157][T16318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 889.638171][T16318] R13: 00007f081b596038 R14: 00007f081b595fa0 R15: 00007ffdeb87b3e8 [ 889.638206][T16318] [ 889.796258][ T64] block nbd0: Possible stuck request ffff888025d0e000: control (read@0,1024B). Runtime 240 seconds [ 889.796307][ T64] block nbd0: Possible stuck request ffff888025d0e1c0: control (read@1024,1024B). Runtime 240 seconds [ 889.796335][ T64] block nbd0: Possible stuck request ffff888025d0e380: control (read@2048,1024B). Runtime 240 seconds [ 889.796363][ T64] block nbd0: Possible stuck request ffff888025d0e540: control (read@3072,1024B). Runtime 240 seconds [ 889.854293][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 889.854328][ C0] lec:lec_tx_timeout: lec0 [ 889.854473][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 890.101160][T13173] usbhid 6-1:1.0: fixing wrong optional hid class descriptors count [ 890.114486][T13173] usbhid 6-1:1.0: can't add hid device: -71 [ 890.114612][T13173] usbhid 6-1:1.0: probe with driver usbhid failed with error -71 [ 890.139065][T13173] usb 6-1: USB disconnect, device number 48 [ 890.428234][T16314] virt_wifi0 speed is unknown, defaulting to 1000 [ 890.514437][ T9] usb 4-1: new full-speed USB device number 81 using dummy_hcd [ 890.747010][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 890.747625][ T9] usb 4-1: not running at top speed; connect to a high speed hub [ 890.748859][ T9] usb 4-1: config 1 has an invalid descriptor of length 81, skipping remainder of the config [ 890.748884][ T9] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 890.751352][ T9] usb 4-1: New USB device found, idVendor=09e8, idProduct=0021, bcdDevice= 0.40 [ 890.751382][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 890.751404][ T9] usb 4-1: Product: syz [ 890.751419][ T9] usb 4-1: Manufacturer: syz [ 890.751436][ T9] usb 4-1: SerialNumber: syz [ 890.868295][ T5811] Bluetooth: hci4: command tx timeout [ 891.789685][ T5811] Bluetooth: hci6: command tx timeout [ 892.155691][ T37] kauditd_printk_skb: 25 callbacks suppressed [ 892.155715][ T37] audit: type=1400 audit(1775126161.350:2464): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=16327 comm="syz.3.3451" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41774 netif=lo [ 892.229703][ T37] audit: type=1400 audit(1775126161.450:2465): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=16327 comm="syz.3.3451" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41774 netif=lo [ 892.453621][ T37] audit: type=1400 audit(1775126161.700:2466): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41774 netif=lo [ 892.562631][ T9] usb 4-1: USB disconnect, device number 81 [ 892.972047][ T5811] Bluetooth: hci4: command tx timeout [ 893.096250][ T6492] udevd[6492]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 893.551366][T15744] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 893.614387][ T9] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 893.774484][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 893.777649][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 893.779229][ T9] usb 4-1: config 1 interface 0 altsetting 255 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 893.779264][ T9] usb 4-1: config 1 interface 0 altsetting 255 endpoint 0x81 has invalid wMaxPacketSize 0 [ 893.779288][ T9] usb 4-1: config 1 interface 0 has no altsetting 0 [ 893.791289][ T9] usb 4-1: New USB device found, idVendor=0c45, idProduct=760b, bcdDevice= 0.40 [ 893.791318][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 893.791337][ T9] usb 4-1: Product: syz [ 893.791351][ T9] usb 4-1: Manufacturer: syz [ 893.791366][ T9] usb 4-1: SerialNumber: syz [ 893.828234][ T5811] Bluetooth: hci6: command tx timeout [ 894.208620][ T5913] usb 6-1: new full-speed USB device number 49 using dummy_hcd [ 894.305093][ T37] audit: type=1400 audit(1775126163.560:2467): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41774 netif=lo [ 894.369281][ T5913] usb 6-1: unable to get BOS descriptor or descriptor too short [ 894.369932][ T5913] usb 6-1: not running at top speed; connect to a high speed hub [ 894.371217][ T5913] usb 6-1: config 1 has an invalid descriptor of length 81, skipping remainder of the config [ 894.371241][ T5913] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 894.373814][ T5913] usb 6-1: New USB device found, idVendor=09e8, idProduct=0021, bcdDevice= 0.40 [ 894.373832][ T5913] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 894.373884][ T5913] usb 6-1: Product: syz [ 894.373893][ T5913] usb 6-1: Manufacturer: syz [ 894.373902][ T5913] usb 6-1: SerialNumber: syz [ 894.386050][ T37] audit: type=1400 audit(1775126163.640:2468): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=35022 netif=lo [ 894.386107][ T37] audit: type=1400 audit(1775126163.640:2469): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=35022 netif=lo [ 894.386156][ T37] audit: type=1400 audit(1775126163.640:2470): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=35022 netif=lo [ 894.386205][ T37] audit: type=1400 audit(1775126163.640:2471): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=35022 netif=lo [ 894.853181][T16383] netlink: 'syz.5.3467': attribute type 39 has an invalid length. [ 894.864587][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 894.864626][ C0] lec:lec_tx_timeout: lec0 [ 894.864740][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 894.901716][T15744] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 894.961067][ T37] audit: type=1400 audit(1775126164.210:2472): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=16367 comm="syz.5.3467" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41776 netif=lo [ 894.961427][ T37] audit: type=1400 audit(1775126164.210:2473): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=16367 comm="syz.5.3467" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41776 netif=lo [ 895.024524][ T5811] Bluetooth: hci4: command tx timeout [ 895.096008][T16357] tc_dump_action: action bad kind [ 895.286144][ T9] usbhid 4-1:1.0: fixing wrong optional hid class descriptors count [ 895.296538][ T9] usbhid 4-1:1.0: can't add hid device: -71 [ 895.296672][ T9] usbhid 4-1:1.0: probe with driver usbhid failed with error -71 [ 895.325090][ T9] usb 4-1: USB disconnect, device number 82 [ 895.549129][ T5913] usb 6-1: USB disconnect, device number 49 [ 895.639464][T15744] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 895.759327][ T6492] udevd[6492]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 895.795246][T16307] chnl_net:caif_netlink_parms(): no params data found [ 895.824425][ T9] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 895.904371][ T5811] Bluetooth: hci6: command tx timeout [ 895.979058][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 896.115298][ T9] usb 4-1: config 0 interface 0 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 25 [ 896.115341][ T9] usb 4-1: config 0 interface 0 has no altsetting 0 [ 896.115380][ T9] usb 4-1: New USB device found, idVendor=146b, idProduct=0902, bcdDevice= 0.00 [ 896.115432][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 896.184544][ T9] usb 4-1: config 0 descriptor?? [ 897.104374][ T5811] Bluetooth: hci4: command tx timeout [ 897.178722][T15744] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 897.497931][ T37] kauditd_printk_skb: 18 callbacks suppressed [ 897.497955][ T37] audit: type=1400 audit(1775126166.750:2492): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41776 netif=lo [ 897.498003][ T37] audit: type=1400 audit(1775126166.750:2493): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41776 netif=lo [ 897.498048][ T37] audit: type=1400 audit(1775126166.750:2494): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41776 netif=lo [ 897.498093][ T37] audit: type=1400 audit(1775126166.750:2495): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41776 netif=lo [ 897.897782][ T9] usbhid 4-1:0.0: can't add hid device: -71 [ 897.927808][ T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 898.754551][ T5811] Bluetooth: hci6: command tx timeout [ 898.869496][ T37] audit: type=1400 audit(1775126168.080:2496): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41774 netif=lo [ 899.251949][ T9] usb 4-1: USB disconnect, device number 83 [ 899.506040][ T37] audit: type=1400 audit(1775126168.760:2497): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41776 netif=lo [ 899.506095][ T37] audit: type=1400 audit(1775126168.760:2498): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41776 netif=lo [ 899.506141][ T37] audit: type=1400 audit(1775126168.760:2499): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41776 netif=lo [ 899.506185][ T37] audit: type=1400 audit(1775126168.760:2500): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41776 netif=lo [ 899.874296][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 899.874346][ C0] lec:lec_tx_timeout: lec0 [ 899.984468][ T9] usb 6-1: new full-speed USB device number 50 using dummy_hcd [ 900.217306][ T9] usb 6-1: unable to get BOS descriptor or descriptor too short [ 900.218073][ T9] usb 6-1: not running at top speed; connect to a high speed hub [ 900.219595][ T9] usb 6-1: config 1 has an invalid descriptor of length 81, skipping remainder of the config [ 900.219622][ T9] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 900.269115][ T9] usb 6-1: New USB device found, idVendor=09e8, idProduct=0021, bcdDevice= 0.40 [ 900.269149][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 900.269169][ T9] usb 6-1: Product: syz [ 900.269184][ T9] usb 6-1: Manufacturer: syz [ 900.269198][ T9] usb 6-1: SerialNumber: syz [ 900.464356][T16314] chnl_net:caif_netlink_parms(): no params data found [ 900.696694][T16439] netlink: 'syz.5.3495': attribute type 39 has an invalid length. [ 900.833662][ T37] audit: type=1400 audit(1775126170.080:2501): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=16437 comm="syz.5.3495" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=34868 netif=lo [ 900.924640][T16307] bridge0: port 1(bridge_slave_0) entered blocking state [ 900.924781][T16307] bridge0: port 1(bridge_slave_0) entered disabled state [ 900.925113][T16307] bridge_slave_0: entered allmulticast mode [ 900.938554][T16307] bridge_slave_0: entered promiscuous mode [ 901.052331][T16466] option changes via remount are deprecated (pid=16464 comm=syz.3.3504) [ 901.121361][T16307] bridge0: port 2(bridge_slave_1) entered blocking state [ 901.121529][T16307] bridge0: port 2(bridge_slave_1) entered disabled state [ 901.121811][T16307] bridge_slave_1: entered allmulticast mode [ 901.138372][T16307] bridge_slave_1: entered promiscuous mode [ 901.167933][T16469] FAULT_INJECTION: forcing a failure. [ 901.167933][T16469] name failslab, interval 1, probability 0, space 0, times 0 [ 901.167974][T16469] CPU: 0 UID: 0 PID: 16469 Comm: syz.2.3506 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 901.168004][T16469] Tainted: [L]=SOFTLOCKUP [ 901.168013][T16469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 901.168026][T16469] Call Trace: [ 901.168036][T16469] [ 901.168045][T16469] dump_stack_lvl+0xe8/0x150 [ 901.168084][T16469] should_fail_ex+0x46b/0x600 [ 901.168120][T16469] should_failslab+0xa8/0x100 [ 901.168157][T16469] __kvmalloc_node_noprof+0x170/0x8e0 [ 901.168184][T16469] ? seq_read_iter+0x203/0xe20 [ 901.168206][T16469] ? mutex_lock_nested+0x152/0x1d0 [ 901.168235][T16469] ? seq_read_iter+0xb8/0xe20 [ 901.168262][T16469] seq_read_iter+0x203/0xe20 [ 901.168307][T16469] ? __asan_memset+0x22/0x50 [ 901.168342][T16469] seq_read+0x36a/0x490 [ 901.168373][T16469] ? __pfx_seq_read+0x10/0x10 [ 901.168391][T16469] ? register_lock_class+0x31/0x2e0 [ 901.168433][T16469] ? __pfx_seq_read+0x10/0x10 [ 901.168451][T16469] proc_reg_read+0x1f6/0x2f0 [ 901.168481][T16469] ? __pfx_proc_reg_read+0x10/0x10 [ 901.168511][T16469] vfs_read+0x212/0xa80 [ 901.168552][T16469] ? __pfx_vfs_read+0x10/0x10 [ 901.168586][T16469] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 901.168610][T16469] ? lockdep_hardirqs_on+0x7a/0x110 [ 901.168632][T16469] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 901.168655][T16469] ? mutex_lock_nested+0x152/0x1d0 [ 901.168683][T16469] ? fdget_pos+0x252/0x320 [ 901.168719][T16469] ksys_read+0x156/0x270 [ 901.168750][T16469] ? __pfx_ksys_read+0x10/0x10 [ 901.168795][T16469] do_syscall_64+0x14d/0xf80 [ 901.168816][T16469] ? trace_irq_disable+0x3b/0x150 [ 901.168840][T16469] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 901.168861][T16469] ? clear_bhb_loop+0x40/0x90 [ 901.168888][T16469] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 901.168908][T16469] RIP: 0033:0x7f66ae43c819 [ 901.168927][T16469] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 901.168947][T16469] RSP: 002b:00007f66ac696028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 901.168970][T16469] RAX: ffffffffffffffda RBX: 00007f66ae6b5fa0 RCX: 00007f66ae43c819 [ 901.168985][T16469] RDX: 0000000000002020 RSI: 0000200000000080 RDI: 0000000000000003 [ 901.168998][T16469] RBP: 00007f66ac696090 R08: 0000000000000000 R09: 0000000000000000 [ 901.169012][T16469] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 901.169025][T16469] R13: 00007f66ae6b6038 R14: 00007f66ae6b5fa0 R15: 00007fffeb0eacf8 [ 901.169062][T16469] [ 901.324384][ T9] usb 6-1: USB disconnect, device number 50 [ 901.720020][T16479] vivid-006: disconnect [ 901.722583][T16478] vivid-006: reconnect [ 901.871318][T16307] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 901.939750][T16307] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 902.104482][ T9] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 902.257855][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 902.260670][ T9] usb 4-1: config 0 has an invalid interface number: 55 but max is 0 [ 902.260699][ T9] usb 4-1: config 0 has no interface number 0 [ 902.260749][ T9] usb 4-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 902.260774][ T9] usb 4-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 902.260801][ T9] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 902.260829][ T9] usb 4-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 902.260876][ T9] usb 4-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 902.260901][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 902.273765][ T9] usb 4-1: config 0 descriptor?? [ 902.343330][ T9] ldusb 4-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 902.539181][T16486] trusted_key: encrypted_key: hex blob is missing [ 902.579329][T13331] usb 4-1: USB disconnect, device number 84 [ 902.602304][T13331] ldusb 4-1:0.55: LD USB Device #0 now disconnected [ 902.785082][ T37] kauditd_printk_skb: 23 callbacks suppressed [ 902.785106][ T37] audit: type=1400 audit(1775126172.040:2525): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=34868 netif=lo [ 902.785246][ T37] audit: type=1400 audit(1775126172.040:2526): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=34868 netif=lo [ 902.785438][ T37] audit: type=1400 audit(1775126172.040:2527): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=34868 netif=lo [ 902.785617][ T37] audit: type=1400 audit(1775126172.040:2528): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=34868 netif=lo [ 904.253243][ T37] audit: type=1400 audit(1775126173.500:2529): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41776 netif=lo [ 904.253301][ T37] audit: type=1400 audit(1775126173.500:2530): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41776 netif=lo [ 904.253346][ T37] audit: type=1400 audit(1775126173.500:2531): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41776 netif=lo [ 904.253388][ T37] audit: type=1400 audit(1775126173.500:2532): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41776 netif=lo [ 904.793729][ T37] audit: type=1400 audit(1775126174.040:2533): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=34868 netif=lo [ 904.793792][ T37] audit: type=1400 audit(1775126174.040:2534): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=34868 netif=lo [ 904.874109][T15744] bond0 (unregistering): Released all slaves [ 905.180236][T16314] bridge0: port 1(bridge_slave_0) entered blocking state [ 905.180426][T16314] bridge0: port 1(bridge_slave_0) entered disabled state [ 905.180683][T16314] bridge_slave_0: entered allmulticast mode [ 905.223703][T16314] bridge_slave_0: entered promiscuous mode [ 905.245855][T16307] team0: Port device team_slave_0 added [ 905.304800][T16314] bridge0: port 2(bridge_slave_1) entered blocking state [ 905.304935][T16314] bridge0: port 2(bridge_slave_1) entered disabled state [ 905.305208][T16314] bridge_slave_1: entered allmulticast mode [ 905.308327][T16314] bridge_slave_1: entered promiscuous mode [ 905.330062][T16307] team0: Port device team_slave_1 added [ 905.547822][T16314] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 905.593765][T16314] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 905.596236][T16307] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 905.596252][T16307] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 905.596276][T16307] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 905.642364][T16307] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 905.642383][T16307] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 905.642408][T16307] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 906.937167][T16314] team0: Port device team_slave_0 added [ 907.062990][T16314] team0: Port device team_slave_1 added [ 907.691098][T16307] hsr_slave_0: entered promiscuous mode [ 907.692658][T16307] hsr_slave_1: entered promiscuous mode [ 907.693704][T16307] debugfs: 'hsr0' already exists in 'hsr' [ 907.693733][T16307] Cannot create hsr debugfs directory [ 907.917031][T16314] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 907.917075][T16314] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 907.917114][T16314] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 908.073268][T16314] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 908.073287][T16314] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 908.073317][T16314] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 908.407264][T16615] FAULT_INJECTION: forcing a failure. [ 908.407264][T16615] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 908.407308][T16615] CPU: 1 UID: 0 PID: 16615 Comm: syz.2.3564 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 908.407339][T16615] Tainted: [L]=SOFTLOCKUP [ 908.407347][T16615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 908.407360][T16615] Call Trace: [ 908.407370][T16615] [ 908.407380][T16615] dump_stack_lvl+0xe8/0x150 [ 908.407420][T16615] should_fail_ex+0x46b/0x600 [ 908.407456][T16615] _copy_from_user+0x2d/0xb0 [ 908.407479][T16615] video_usercopy+0x36f/0x14b0 [ 908.407516][T16615] ? smk_tskacc+0x311/0x3a0 [ 908.407548][T16615] ? __pfx___video_do_ioctl+0x10/0x10 [ 908.407584][T16615] ? __pfx_video_usercopy+0x10/0x10 [ 908.407614][T16615] ? smack_file_ioctl+0x2c2/0x360 [ 908.407667][T16615] ? __fget_files+0x2a/0x420 [ 908.407697][T16615] ? __fget_files+0x3a6/0x420 [ 908.407730][T16615] v4l2_ioctl+0x190/0x1e0 [ 908.407763][T16615] ? __pfx_v4l2_ioctl+0x10/0x10 [ 908.407794][T16615] __se_sys_ioctl+0xff/0x170 [ 908.407820][T16615] do_syscall_64+0x14d/0xf80 [ 908.407844][T16615] ? trace_irq_disable+0x3b/0x150 [ 908.407871][T16615] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 908.407894][T16615] ? clear_bhb_loop+0x40/0x90 [ 908.407921][T16615] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 908.407944][T16615] RIP: 0033:0x7f66ae43c819 [ 908.407965][T16615] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 908.407983][T16615] RSP: 002b:00007f66ac696028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 908.408009][T16615] RAX: ffffffffffffffda RBX: 00007f66ae6b5fa0 RCX: 00007f66ae43c819 [ 908.408025][T16615] RDX: 0000200000000100 RSI: 00000000c034564b RDI: 0000000000000003 [ 908.408040][T16615] RBP: 00007f66ac696090 R08: 0000000000000000 R09: 0000000000000000 [ 908.408054][T16615] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 908.408068][T16615] R13: 00007f66ae6b6038 R14: 00007f66ae6b5fa0 R15: 00007fffeb0eacf8 [ 908.408104][T16615] [ 908.705386][ T37] kauditd_printk_skb: 3 callbacks suppressed [ 908.705407][ T37] audit: type=1400 audit(1775126177.960:2538): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=34868 netif=lo [ 908.705606][ T37] audit: type=1400 audit(1775126177.960:2539): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=34868 netif=lo [ 908.705845][ T37] audit: type=1400 audit(1775126177.960:2540): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=34868 netif=lo [ 908.706045][ T37] audit: type=1400 audit(1775126177.960:2541): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=34868 netif=lo [ 908.914778][T15744] hsr_slave_0: left promiscuous mode [ 908.954801][T15744] hsr_slave_1: left promiscuous mode [ 908.964800][T13173] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 909.011911][T15744] veth1_macvtap: left promiscuous mode [ 909.012032][T15744] veth0_macvtap: left promiscuous mode [ 909.012309][T15744] veth1_vlan: left promiscuous mode [ 909.012500][T15744] veth0_vlan: left promiscuous mode [ 909.117731][T13173] usb 6-1: unable to get BOS descriptor or descriptor too short [ 909.120889][T13173] usb 6-1: config 1 interface 0 altsetting 6 bulk endpoint 0x1 has invalid maxpacket 8 [ 909.120926][T13173] usb 6-1: config 1 interface 0 altsetting 6 bulk endpoint 0x82 has invalid maxpacket 1024 [ 909.120952][T13173] usb 6-1: config 1 interface 0 has no altsetting 0 [ 909.127867][T13173] usb 6-1: string descriptor 0 read error: -22 [ 909.128013][T13173] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 909.128037][T13173] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 909.166164][T16616] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 909.166351][T16616] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 910.099766][T13173] usblp 6-1:1.0: usblp0: USB Bidirectional printer dev 51 if 0 alt 6 proto 2 vid 0x0525 pid 0xA4A8 [ 910.152323][T13173] usb 6-1: USB disconnect, device number 51 [ 910.242014][T13173] usblp0: removed [ 911.054412][ T5913] usb 6-1: new high-speed USB device number 52 using dummy_hcd [ 911.214453][ T5913] usb 6-1: Using ep0 maxpacket: 16 [ 911.219897][ T5913] usb 6-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 911.219933][ T5913] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 911.219955][ T5913] usb 6-1: Product: syz [ 911.219970][ T5913] usb 6-1: Manufacturer: syz [ 911.219986][ T5913] usb 6-1: SerialNumber: syz [ 911.281278][ T5913] usb 6-1: config 0 descriptor?? [ 911.791269][ T5913] dvb_usb_dtv5100 6-1:0.0: probe with driver dvb_usb_dtv5100 failed with error -71 [ 911.846543][ T5913] usb 6-1: USB disconnect, device number 52 [ 912.130922][T16314] hsr_slave_0: entered promiscuous mode [ 912.132513][T16314] hsr_slave_1: entered promiscuous mode [ 912.133540][T16314] debugfs: 'hsr0' already exists in 'hsr' [ 912.133568][T16314] Cannot create hsr debugfs directory [ 912.179877][ T37] audit: type=1400 audit(1775126181.430:2542): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41776 netif=lo [ 912.179947][ T37] audit: type=1400 audit(1775126181.430:2543): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41776 netif=lo [ 912.179997][ T37] audit: type=1400 audit(1775126181.430:2544): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41776 netif=lo [ 912.180044][ T37] audit: type=1400 audit(1775126181.430:2545): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41776 netif=lo [ 912.754441][ T5809] usb 6-1: new high-speed USB device number 53 using dummy_hcd [ 912.926788][ T5809] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 912.926826][ T5809] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 912.926868][ T5809] usb 6-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 912.926894][ T5809] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 912.994516][ T5809] usb 6-1: config 0 descriptor?? [ 913.500652][ T5809] playstation 0003:054C:0DF2.0020: unknown main item tag 0x0 [ 913.500691][ T5809] playstation 0003:054C:0DF2.0020: unknown main item tag 0x0 [ 913.500719][ T5809] playstation 0003:054C:0DF2.0020: unknown main item tag 0x0 [ 913.500745][ T5809] playstation 0003:054C:0DF2.0020: unknown main item tag 0x0 [ 913.500772][ T5809] playstation 0003:054C:0DF2.0020: unknown main item tag 0x0 [ 913.524499][ T5809] playstation 0003:054C:0DF2.0020: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.5-1/input0 [ 913.638867][ T5809] playstation 0003:054C:0DF2.0020: Invalid byte count transferred, expected 20 got 0 [ 913.638900][ T5809] playstation 0003:054C:0DF2.0020: Failed to retrieve DualSense pairing info: -22 [ 913.638958][ T5809] playstation 0003:054C:0DF2.0020: Failed to get MAC address from DualSense [ 913.639000][ T5809] playstation 0003:054C:0DF2.0020: Failed to create dualsense. [ 913.716359][ T5809] playstation 0003:054C:0DF2.0020: probe with driver playstation failed with error -22 [ 914.119678][T16307] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 914.119707][T16307] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 914.415172][ T5887] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 914.476517][T16735] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 914.477168][T16735] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 914.577212][ T5887] usb 4-1: unable to get BOS descriptor or descriptor too short [ 914.578700][ T5887] usb 4-1: config 1 interface 0 altsetting 6 bulk endpoint 0x1 has invalid maxpacket 8 [ 914.578733][ T5887] usb 4-1: config 1 interface 0 altsetting 6 bulk endpoint 0x82 has invalid maxpacket 1024 [ 914.578761][ T5887] usb 4-1: config 1 interface 0 has no altsetting 0 [ 914.584167][ T5887] usb 4-1: string descriptor 0 read error: -22 [ 914.625220][ T5887] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 914.625254][ T5887] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 914.656148][T16726] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 914.656290][T16726] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 915.446973][T16307] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 915.447018][T16307] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 915.788646][ T5809] usb 6-1: USB disconnect, device number 53 [ 915.913792][ T5887] usblp 4-1:1.0: usblp0: USB Bidirectional printer dev 85 if 0 alt 6 proto 2 vid 0x0525 pid 0xA4A8 [ 915.934707][ T5887] usb 4-1: USB disconnect, device number 85 [ 915.943258][ T5887] usblp0: removed [ 916.152834][T16307] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 916.152876][T16307] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 916.462251][T16774] FAULT_INJECTION: forcing a failure. [ 916.462251][T16774] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 916.462305][T16774] CPU: 0 UID: 0 PID: 16774 Comm: syz.5.3618 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 916.462339][T16774] Tainted: [L]=SOFTLOCKUP [ 916.462356][T16774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 916.462370][T16774] Call Trace: [ 916.462380][T16774] [ 916.462391][T16774] dump_stack_lvl+0xe8/0x150 [ 916.462432][T16774] should_fail_ex+0x46b/0x600 [ 916.462468][T16774] prepare_alloc_pages+0x22a/0x6b0 [ 916.462503][T16774] __alloc_frozen_pages_noprof+0x12f/0x380 [ 916.462535][T16774] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 916.462564][T16774] ? __pfx_policy_nodemask+0x10/0x10 [ 916.462587][T16774] ? lockdep_hardirqs_on+0x7a/0x110 [ 916.462615][T16774] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 916.462646][T16774] ? reacquire_held_locks+0x104/0x190 [ 916.462678][T16774] alloc_pages_mpol+0xd1/0x380 [ 916.462706][T16774] alloc_pages_noprof+0xce/0x1e0 [ 916.462735][T16774] get_free_pages_noprof+0xf/0x80 [ 916.462761][T16774] __pollwait+0x263/0x430 [ 916.462788][T16774] ? __pfx___pollwait+0x10/0x10 [ 916.462814][T16774] snd_rawmidi_poll+0x178/0x450 [ 916.462841][T16774] ? __pfx_snd_rawmidi_poll+0x10/0x10 [ 916.462867][T16774] do_select+0x101e/0x15c0 [ 916.462903][T16774] ? do_select+0x7a1/0x15c0 [ 916.462945][T16774] ? __pfx_do_select+0x10/0x10 [ 916.462967][T16774] ? __schedule+0x1569/0x5240 [ 916.462997][T16774] ? __pfx___pollwait+0x10/0x10 [ 916.463027][T16774] ? __pfx_pollwake+0x10/0x10 [ 916.463059][T16774] ? __pfx_pollwake+0x10/0x10 [ 916.463089][T16774] ? __pfx_pollwake+0x10/0x10 [ 916.463118][T16774] ? __pfx_pollwake+0x10/0x10 [ 916.463149][T16774] ? __pfx_pollwake+0x10/0x10 [ 916.463179][T16774] ? __pfx_pollwake+0x10/0x10 [ 916.463209][T16774] ? __pfx_pollwake+0x10/0x10 [ 916.463239][T16774] ? __pfx_pollwake+0x10/0x10 [ 916.463269][T16774] ? __pfx_pollwake+0x10/0x10 [ 916.463320][T16774] core_sys_select+0x898/0xc30 [ 916.463375][T16774] ? __pfx_core_sys_select+0x10/0x10 [ 916.463444][T16774] __se_sys_pselect6+0x267/0x320 [ 916.463478][T16774] ? __pfx___se_sys_pselect6+0x10/0x10 [ 916.463505][T16774] ? __pfx_ksys_write+0x10/0x10 [ 916.463544][T16774] ? __x64_sys_pselect6+0x21/0xf0 [ 916.463574][T16774] do_syscall_64+0x14d/0xf80 [ 916.463598][T16774] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 916.463620][T16774] ? clear_bhb_loop+0x40/0x90 [ 916.463648][T16774] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 916.463672][T16774] RIP: 0033:0x7fcda5ebc819 [ 916.463694][T16774] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 916.463712][T16774] RSP: 002b:00007fcda40ed028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 916.463736][T16774] RAX: ffffffffffffffda RBX: 00007fcda6136090 RCX: 00007fcda5ebc819 [ 916.463753][T16774] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000040 [ 916.463768][T16774] RBP: 00007fcda40ed090 R08: 0000000000000000 R09: 0000000000000000 [ 916.463782][T16774] R10: 00002000000002c0 R11: 0000000000000246 R12: 0000000000000001 [ 916.463796][T16774] R13: 00007fcda6136128 R14: 00007fcda6136090 R15: 00007fff9a758018 [ 916.463832][T16774] [ 916.625997][ T37] audit: type=1400 audit(1775126185.880:2546): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=34868 netif=lo [ 916.627952][ T37] audit: type=1400 audit(1775126185.880:2547): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=34868 netif=lo [ 916.628098][ T37] audit: type=1400 audit(1775126185.880:2548): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=34868 netif=lo [ 916.628236][ T37] audit: type=1400 audit(1775126185.880:2549): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=34868 netif=lo [ 916.628323][ T37] audit: type=1400 audit(1775126185.880:2550): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=35022 netif=lo [ 916.628463][ T37] audit: type=1400 audit(1775126185.880:2551): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=35022 netif=lo [ 916.628602][ T37] audit: type=1400 audit(1775126185.880:2552): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=35022 netif=lo [ 916.628734][ T37] audit: type=1400 audit(1775126185.880:2553): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=35022 netif=lo [ 917.482388][T16780] FAULT_INJECTION: forcing a failure. [ 917.482388][T16780] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 917.482428][T16780] CPU: 0 UID: 0 PID: 16780 Comm: syz.2.3620 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 917.482457][T16780] Tainted: [L]=SOFTLOCKUP [ 917.482465][T16780] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 917.482478][T16780] Call Trace: [ 917.482487][T16780] [ 917.482496][T16780] dump_stack_lvl+0xe8/0x150 [ 917.482533][T16780] should_fail_ex+0x46b/0x600 [ 917.482567][T16780] _copy_from_iter+0x1d3/0x1670 [ 917.482607][T16780] ? trace_kmem_cache_alloc+0x29/0xf0 [ 917.482638][T16780] ? __alloc_skb+0x27d/0x7d0 [ 917.482658][T16780] ? __pfx__copy_from_iter+0x10/0x10 [ 917.482686][T16780] ? kmem_cache_alloc_node_noprof+0x27c/0x6e0 [ 917.482718][T16780] ? __alloc_skb+0x27d/0x7d0 [ 917.482744][T16780] ? netlink_sendmsg+0x650/0xb40 [ 917.482774][T16780] ? skb_put+0x11b/0x210 [ 917.482800][T16780] netlink_sendmsg+0x6c0/0xb40 [ 917.482845][T16780] ? __pfx_netlink_sendmsg+0x10/0x10 [ 917.482881][T16780] ? unwind_get_return_address+0x4d/0x90 [ 917.482910][T16780] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 917.482948][T16780] ____sys_sendmsg+0x94c/0x9c0 [ 917.482980][T16780] ? __pfx_____sys_sendmsg+0x10/0x10 [ 917.483017][T16780] ? import_iovec+0x73/0xa0 [ 917.483055][T16780] ___sys_sendmsg+0x2a5/0x360 [ 917.483087][T16780] ? __pfx____sys_sendmsg+0x10/0x10 [ 917.483151][T16780] ? __fget_files+0x2a/0x420 [ 917.483180][T16780] ? __fget_files+0x3a6/0x420 [ 917.483220][T16780] __x64_sys_sendmsg+0x1c3/0x2a0 [ 917.483249][T16780] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 917.483287][T16780] ? __pfx_ksys_write+0x10/0x10 [ 917.483334][T16780] do_syscall_64+0x14d/0xf80 [ 917.483359][T16780] ? trace_irq_disable+0x3b/0x150 [ 917.483425][T16780] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 917.483449][T16780] ? clear_bhb_loop+0x40/0x90 [ 917.483477][T16780] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 917.483500][T16780] RIP: 0033:0x7f66ae43c819 [ 917.483521][T16780] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 917.483541][T16780] RSP: 002b:00007f66ac675028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 917.483566][T16780] RAX: ffffffffffffffda RBX: 00007f66ae6b6090 RCX: 00007f66ae43c819 [ 917.483582][T16780] RDX: 0000000000000800 RSI: 0000200000000180 RDI: 0000000000000005 [ 917.483597][T16780] RBP: 00007f66ac675090 R08: 0000000000000000 R09: 0000000000000000 [ 917.483611][T16780] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 917.483624][T16780] R13: 00007f66ae6b6128 R14: 00007f66ae6b6090 R15: 00007fffeb0eacf8 [ 917.483660][T16780] [ 917.501162][T16307] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 917.501199][T16307] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 917.836685][T13705] lec:lec_start_xmit: lec0:No lecd attached [ 918.063304][T15744] bridge_slave_1: left allmulticast mode [ 918.063335][T15744] bridge_slave_1: left promiscuous mode [ 918.063617][T15744] bridge0: port 2(bridge_slave_1) entered disabled state [ 918.220103][T15744] bridge_slave_0: left allmulticast mode [ 918.220138][T15744] bridge_slave_0: left promiscuous mode [ 918.220434][T15744] bridge0: port 1(bridge_slave_0) entered disabled state [ 918.665713][T16811] FAULT_INJECTION: forcing a failure. [ 918.665713][T16811] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 918.665752][T16811] CPU: 1 UID: 0 PID: 16811 Comm: syz.3.3629 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 918.665784][T16811] Tainted: [L]=SOFTLOCKUP [ 918.665792][T16811] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 918.665804][T16811] Call Trace: [ 918.665813][T16811] [ 918.665823][T16811] dump_stack_lvl+0xe8/0x150 [ 918.665861][T16811] should_fail_ex+0x46b/0x600 [ 918.665897][T16811] _copy_from_iter+0x1d3/0x1670 [ 918.665927][T16811] ? rcu_is_watching+0x15/0xb0 [ 918.665952][T16811] ? trace_kmem_cache_alloc+0x29/0xf0 [ 918.665989][T16811] ? __alloc_skb+0x27d/0x7d0 [ 918.666012][T16811] ? __pfx__copy_from_iter+0x10/0x10 [ 918.666047][T16811] ? skb_page_frag_refill+0x1be/0x310 [ 918.666085][T16811] tcp_sendmsg_locked+0x2157/0x5490 [ 918.666108][T16811] ? __lock_acquire+0x6b5/0x2cf0 [ 918.666198][T16811] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 918.666233][T16811] ? __local_bh_enable_ip+0x1ae/0x2b0 [ 918.666263][T16811] ? lockdep_hardirqs_on+0x7a/0x110 [ 918.666290][T16811] ? __pfx_inet_sendmsg+0x10/0x10 [ 918.666313][T16811] tcp_sendmsg+0x2f/0x50 [ 918.666336][T16811] __sys_sendto+0x5f1/0x710 [ 918.666365][T16811] ? __pfx___sys_sendto+0x10/0x10 [ 918.666421][T16811] ? ksys_write+0x248/0x270 [ 918.666456][T16811] ? __pfx_ksys_write+0x10/0x10 [ 918.666494][T16811] __x64_sys_sendto+0xde/0x100 [ 918.666521][T16811] do_syscall_64+0x14d/0xf80 [ 918.666542][T16811] ? trace_irq_disable+0x3b/0x150 [ 918.666566][T16811] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 918.666588][T16811] ? clear_bhb_loop+0x40/0x90 [ 918.666615][T16811] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 918.666637][T16811] RIP: 0033:0x7f081b31c819 [ 918.666659][T16811] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 918.666679][T16811] RSP: 002b:00007f0819576028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 918.666705][T16811] RAX: ffffffffffffffda RBX: 00007f081b595fa0 RCX: 00007f081b31c819 [ 918.666721][T16811] RDX: 0000000000000381 RSI: 00002000000004c0 RDI: 0000000000000003 [ 918.666736][T16811] RBP: 00007f0819576090 R08: 0000000000000000 R09: 0000000000000000 [ 918.666750][T16811] R10: 0000000000000805 R11: 0000000000000246 R12: 0000000000000001 [ 918.666764][T16811] R13: 00007f081b596038 R14: 00007f081b595fa0 R15: 00007ffdeb87b3e8 [ 918.666799][T16811] [ 918.944525][ T5888] usb 6-1: new high-speed USB device number 54 using dummy_hcd [ 919.037675][ T5887] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 919.103837][ T5888] usb 6-1: unable to get BOS descriptor or descriptor too short [ 919.116805][ T5888] usb 6-1: config 1 interface 0 altsetting 6 bulk endpoint 0x1 has invalid maxpacket 8 [ 919.116842][ T5888] usb 6-1: config 1 interface 0 altsetting 6 bulk endpoint 0x82 has invalid maxpacket 1024 [ 919.116870][ T5888] usb 6-1: config 1 interface 0 has no altsetting 0 [ 919.120013][ T5888] usb 6-1: string descriptor 0 read error: -22 [ 919.120142][ T5888] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 919.120158][ T5888] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 919.190423][T16809] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 919.190582][T16809] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 919.214596][ T5887] usb 4-1: Using ep0 maxpacket: 16 [ 919.218841][ T5887] usb 4-1: config 0 interface 0 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 25 [ 919.218941][ T5887] usb 4-1: config 0 interface 0 has no altsetting 0 [ 919.219146][ T5887] usb 4-1: New USB device found, idVendor=146b, idProduct=0902, bcdDevice= 0.00 [ 919.219173][ T5887] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 919.257926][ T5887] usb 4-1: config 0 descriptor?? [ 919.679479][ T5887] hid (null): invalid report_size 29797 [ 919.679586][ T5887] hid (null): invalid report_size 29696 [ 919.712614][ T5887] bigben 0003:146B:0902.0021: unexpected rdesc, please submit for review [ 919.768093][ T5887] bigben 0003:146B:0902.0021: unknown main item tag 0x0 [ 919.769047][ T5887] bigben 0003:146B:0902.0021: unknown main item tag 0x0 [ 919.769836][ T5887] bigben 0003:146B:0902.0021: unknown main item tag 0x0 [ 919.769874][ T5887] bigben 0003:146B:0902.0021: unknown main item tag 0x0 [ 919.769901][ T5887] bigben 0003:146B:0902.0021: unknown main item tag 0x0 [ 919.769928][ T5887] bigben 0003:146B:0902.0021: unknown main item tag 0x0 [ 919.777387][ T5887] bigben 0003:146B:0902.0021: unknown main item tag 0x0 [ 919.777426][ T5887] bigben 0003:146B:0902.0021: invalid report_size 29797 [ 919.777442][ T5887] bigben 0003:146B:0902.0021: item 0 2 1 7 parsing failed [ 919.791443][ T5887] bigben 0003:146B:0902.0021: parse failed [ 919.792770][ T5887] bigben 0003:146B:0902.0021: probe with driver bigben failed with error -22 [ 919.890345][ T64] block nbd0: Possible stuck request ffff888025d0e000: control (read@0,1024B). Runtime 270 seconds [ 919.890474][ T64] block nbd0: Possible stuck request ffff888025d0e1c0: control (read@1024,1024B). Runtime 270 seconds [ 919.890517][ T64] block nbd0: Possible stuck request ffff888025d0e380: control (read@2048,1024B). Runtime 270 seconds [ 919.890549][ T64] block nbd0: Possible stuck request ffff888025d0e540: control (read@3072,1024B). Runtime 270 seconds [ 919.933708][ T5887] usb 4-1: USB disconnect, device number 86 [ 920.102654][ T5888] usblp 6-1:1.0: usblp0: USB Bidirectional printer dev 54 if 0 alt 6 proto 2 vid 0x0525 pid 0xA4A8 [ 920.176266][ T5888] usb 6-1: USB disconnect, device number 54 [ 920.214659][ T5888] usblp0: removed [ 921.064469][ T5809] usb 4-1: new full-speed USB device number 87 using dummy_hcd [ 921.105428][T13331] usb 6-1: new low-speed USB device number 55 using dummy_hcd [ 921.108779][ T37] audit: type=1400 audit(1775126190.360:2554): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41774 netif=lo [ 921.228261][ T5809] usb 4-1: config 0 has an invalid interface number: 2 but max is 0 [ 921.228293][ T5809] usb 4-1: config 0 has no interface number 0 [ 921.228343][ T5809] usb 4-1: config 0 interface 2 altsetting 2 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 921.228375][ T5809] usb 4-1: config 0 interface 2 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 921.228402][ T5809] usb 4-1: config 0 interface 2 altsetting 2 endpoint 0x82 has invalid maxpacket 192, setting to 64 [ 921.228431][ T5809] usb 4-1: config 0 interface 2 has no altsetting 0 [ 921.233007][ T5809] usb 4-1: New USB device found, idVendor=086a, idProduct=0003, bcdDevice=f0.3f [ 921.233030][ T5809] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 921.233042][ T5809] usb 4-1: Product: syz [ 921.233059][ T5809] usb 4-1: Manufacturer: syz [ 921.233068][ T5809] usb 4-1: SerialNumber: syz [ 921.327837][T13331] usb 6-1: No LPM exit latency info found, disabling LPM. [ 921.334481][T13331] usb 6-1: config index 0 descriptor too short (expected 12288, got 36) [ 921.334510][T13331] usb 6-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 921.334532][T13331] usb 6-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 921.334552][T13331] usb 6-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 921.360289][T13331] usb 6-1: string descriptor 0 read error: -22 [ 921.360409][T13331] usb 6-1: New USB device found, idVendor=05ac, idProduct=0222, bcdDevice= 0.40 [ 921.360431][T13331] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 921.404089][ T5809] usb 4-1: config 0 descriptor?? [ 921.419288][T16849] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 921.420639][T16849] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 921.634646][ T5809] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 921.662238][ T5888] usb 6-1: USB disconnect, device number 55 [ 921.814909][ T5809] usb 4-1: USB disconnect, device number 87 [ 921.901387][T15744] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 921.991834][ T5963] udevd[5963]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 922.025368][T15744] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 922.115968][T15744] bond0 (unregistering): (slave bond2): Releasing backup interface [ 922.165502][T15744] bond0 (unregistering): Released all slaves [ 922.183954][T15744] bond1 (unregistering): Released all slaves [ 922.212018][T15744] bond2 (unregistering): Released all slaves [ 922.915989][T16891] netlink: 180 bytes leftover after parsing attributes in process `syz.5.3661'. [ 923.634581][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5800 ms [ 923.634620][ C0] lec:lec_tx_timeout: lec0 [ 924.014482][ T5888] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 924.177588][ T5888] usb 4-1: unable to get BOS descriptor or descriptor too short [ 924.179208][ T5888] usb 4-1: config 1 interface 0 altsetting 6 bulk endpoint 0x1 has invalid maxpacket 8 [ 924.179242][ T5888] usb 4-1: config 1 interface 0 altsetting 6 bulk endpoint 0x82 has invalid maxpacket 1024 [ 924.179269][ T5888] usb 4-1: config 1 interface 0 has no altsetting 0 [ 924.187463][ T5888] usb 4-1: string descriptor 0 read error: -22 [ 924.187633][ T5888] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 924.187660][ T5888] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 924.230363][T16889] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 924.230663][T16889] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 924.772380][T16307] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 924.993516][T16307] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 925.505139][ T5888] usblp 4-1:1.0: usblp0: USB Bidirectional printer dev 88 if 0 alt 6 proto 2 vid 0x0525 pid 0xA4A8 [ 925.573542][ T5888] usb 4-1: USB disconnect, device number 88 [ 925.601594][ T5888] usblp0: removed [ 925.702114][T15744] tipc: Disabling bearer [ 925.702381][T15744] tipc: Left network mode [ 925.751066][T16307] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 926.150406][T16307] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 927.795663][ T9] usb 4-1: new full-speed USB device number 89 using dummy_hcd [ 927.963273][T16314] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 927.967856][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 927.969532][ T9] usb 4-1: not running at top speed; connect to a high speed hub [ 927.971094][ T9] usb 4-1: config 1 has an invalid descriptor of length 81, skipping remainder of the config [ 927.971120][ T9] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 927.982166][ T9] usb 4-1: New USB device found, idVendor=09e8, idProduct=0021, bcdDevice= 0.40 [ 927.982201][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 927.982224][ T9] usb 4-1: Product: syz [ 927.982240][ T9] usb 4-1: Manufacturer: syz [ 927.982256][ T9] usb 4-1: SerialNumber: syz [ 928.656466][ T37] audit: type=1400 audit(1775126197.910:2555): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=16929 comm="syz.3.3676" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=56918 netif=lo [ 928.661132][ T37] audit: type=1400 audit(1775126197.910:2556): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=16929 comm="syz.3.3676" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=56918 netif=lo [ 928.858197][ T37] audit: type=1400 audit(1775126198.110:2557): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41776 netif=lo [ 928.858458][ T37] audit: type=1400 audit(1775126198.110:2558): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41776 netif=lo [ 928.858680][ T37] audit: type=1400 audit(1775126198.110:2559): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41776 netif=lo [ 928.858874][ T37] audit: type=1400 audit(1775126198.110:2560): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=41776 netif=lo [ 928.925024][ T37] audit: type=1400 audit(1775126198.180:2561): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=16 comm="ktimers/0" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=56918 netif=lo [ 928.999779][T16314] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 929.107392][T15744] IPVS: stopping backup sync thread 12474 ... [ 929.157110][ T9] usb 4-1: USB disconnect, device number 89 [ 929.219218][T16314] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 929.309507][T16314] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 929.468715][ T6492] udevd[6492]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 929.630552][ T5809] usb 6-1: new high-speed USB device number 56 using dummy_hcd [ 929.804460][ T5809] usb 6-1: unable to get BOS descriptor or descriptor too short [ 929.805748][ T5809] usb 6-1: config 1 interface 0 altsetting 6 bulk endpoint 0x1 has invalid maxpacket 8 [ 929.805781][ T5809] usb 6-1: config 1 interface 0 altsetting 6 bulk endpoint 0x82 has invalid maxpacket 1024 [ 929.805806][ T5809] usb 6-1: config 1 interface 0 has no altsetting 0 [ 929.825893][ T5809] usb 6-1: string descriptor 0 read error: -22 [ 929.826136][ T5809] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 929.826160][ T5809] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 929.853631][T16962] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 929.853783][T16962] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 930.546912][ T37] audit: type=1400 audit(1775126199.800:2562): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=16 comm="ktimers/0" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=56918 netif=lo [ 931.298455][ T5809] usblp 6-1:1.0: usblp0: USB Bidirectional printer dev 56 if 0 alt 6 proto 2 vid 0x0525 pid 0xA4A8 [ 931.314712][ T5809] usb 6-1: USB disconnect, device number 56 [ 931.326219][ T5809] usblp0: removed [ 931.355146][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.359644][ T1306] lec:lec_start_xmit: lec0:No lecd attached [ 932.112629][T17021] usb usb1: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 932.371535][ T5887] usb 6-1: new high-speed USB device number 57 using dummy_hcd [ 932.455006][T16307] 8021q: adding VLAN 0 to HW filter on device bond0 [ 932.567475][ T5887] usb 6-1: unable to get BOS descriptor or descriptor too short [ 932.570532][ T5887] usb 6-1: config 1 has an invalid descriptor of length 216, skipping remainder of the config [ 932.570564][ T5887] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 932.580807][ T5887] usb 6-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 932.580839][ T5887] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 932.580859][ T5887] usb 6-1: Product: syz [ 932.580873][ T5887] usb 6-1: Manufacturer: syz [ 932.580887][ T5887] usb 6-1: SerialNumber: syz [ 932.629096][ T37] audit: type=1400 audit(1775126201.880:2563): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=34868 netif=lo [ 932.629153][ T37] audit: type=1400 audit(1775126201.880:2564): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=34868 netif=lo [ 933.049454][T17032] FAULT_INJECTION: forcing a failure. [ 933.049454][T17032] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 933.049523][T17032] CPU: 1 UID: 0 PID: 17032 Comm: syz.2.3707 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 933.049555][T17032] Tainted: [L]=SOFTLOCKUP [ 933.049564][T17032] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 933.049578][T17032] Call Trace: [ 933.049588][T17032] [ 933.049598][T17032] dump_stack_lvl+0xe8/0x150 [ 933.049639][T17032] should_fail_ex+0x46b/0x600 [ 933.049677][T17032] _copy_from_user+0x2d/0xb0 [ 933.049700][T17032] do_handle_open+0x57b/0x970 [ 933.049727][T17032] ? __pfx_do_handle_open+0x10/0x10 [ 933.049752][T17032] ? ksys_write+0x248/0x270 [ 933.049790][T17032] ? __pfx_ksys_write+0x10/0x10 [ 933.049837][T17032] do_syscall_64+0x14d/0xf80 [ 933.049862][T17032] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 933.049885][T17032] ? clear_bhb_loop+0x40/0x90 [ 933.049913][T17032] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 933.049936][T17032] RIP: 0033:0x7f66ae43c819 [ 933.049958][T17032] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 933.049986][T17032] RSP: 002b:00007f66ac654028 EFLAGS: 00000246 ORIG_RAX: 0000000000000130 [ 933.050011][T17032] RAX: ffffffffffffffda RBX: 00007f66ae6b6180 RCX: 00007f66ae43c819 [ 933.050027][T17032] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 000000000000000a [ 933.050042][T17032] RBP: 00007f66ac654090 R08: 0000000000000000 R09: 0000000000000000 [ 933.050056][T17032] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 933.050070][T17032] R13: 00007f66ae6b6218 R14: 00007f66ae6b6180 R15: 00007fffeb0eacf8 [ 933.050107][T17032] [ 933.968920][ T37] kauditd_printk_skb: 2 callbacks suppressed [ 933.968943][ T37] audit: type=1400 audit(1775126203.210:2567): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=5888 comm="kworker/0:5" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=56918 netif=lo [ 934.318393][T16307] 8021q: adding VLAN 0 to HW filter on device team0 [ 934.349039][T16314] 8021q: adding VLAN 0 to HW filter on device bond0 [ 934.527569][ T1559] bridge0: port 1(bridge_slave_0) entered blocking state [ 934.527724][ T1559] bridge0: port 1(bridge_slave_0) entered forwarding state [ 934.812750][ T158] bridge0: port 2(bridge_slave_1) entered blocking state [ 934.821339][ T158] bridge0: port 2(bridge_slave_1) entered forwarding state [ 934.986563][T16314] 8021q: adding VLAN 0 to HW filter on device team0 [ 935.066537][T15676] bridge0: port 1(bridge_slave_0) entered blocking state [ 935.066662][T15676] bridge0: port 1(bridge_slave_0) entered forwarding state [ 935.337592][ T1327] bridge0: port 2(bridge_slave_1) entered blocking state [ 935.337723][ T1327] bridge0: port 2(bridge_slave_1) entered forwarding state [ 935.853000][ T5887] usb 6-1: USB disconnect, device number 57 [ 936.648904][ T5887] usb 6-1: new high-speed USB device number 58 using dummy_hcd [ 936.704330][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5350 ms [ 936.704368][ C0] lec:lec_tx_timeout: lec0 [ 936.821665][ T5887] usb 6-1: unable to get BOS descriptor or descriptor too short [ 936.823504][ T5887] usb 6-1: config 1 has an invalid descriptor of length 216, skipping remainder of the config [ 936.823534][ T5887] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 936.859750][ T5887] usb 6-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 936.859786][ T5887] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 936.859809][ T5887] usb 6-1: Product: syz [ 936.859824][ T5887] usb 6-1: Manufacturer: syz [ 936.859839][ T5887] usb 6-1: SerialNumber: syz [ 936.937758][T17087] FAULT_INJECTION: forcing a failure. [ 936.937758][T17087] name failslab, interval 1, probability 0, space 0, times 0 [ 936.937801][T17087] CPU: 0 UID: 0 PID: 17087 Comm: syz.3.3728 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 936.937831][T17087] Tainted: [L]=SOFTLOCKUP [ 936.937845][T17087] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 936.937859][T17087] Call Trace: [ 936.937868][T17087] [ 936.937879][T17087] dump_stack_lvl+0xe8/0x150 [ 936.937918][T17087] should_fail_ex+0x46b/0x600 [ 936.937953][T17087] should_failslab+0xa8/0x100 [ 936.937977][T17087] __kmalloc_noprof+0xdf/0x7b0 [ 936.937999][T17087] ? iovec_from_user+0x87/0x250 [ 936.938038][T17087] iovec_from_user+0x87/0x250 [ 936.938087][T17087] __import_iovec+0x163/0x7e0 [ 936.938133][T17087] import_iovec+0x73/0xa0 [ 936.938170][T17087] ___sys_recvmsg+0x4bd/0x590 [ 936.938213][T17087] ? __pfx____sys_recvmsg+0x10/0x10 [ 936.938260][T17087] ? __fget_files+0x3a6/0x420 [ 936.938302][T17087] do_recvmmsg+0x33a/0x800 [ 936.938338][T17087] ? __pfx_do_recvmmsg+0x10/0x10 [ 936.938379][T17087] ? _copy_from_user+0x94/0xb0 [ 936.938416][T17087] __x64_sys_recvmmsg+0x1b7/0x250 [ 936.938447][T17087] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 936.938486][T17087] do_syscall_64+0x14d/0xf80 [ 936.938510][T17087] ? trace_irq_disable+0x3b/0x150 [ 936.938536][T17087] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 936.938559][T17087] ? clear_bhb_loop+0x40/0x90 [ 936.938585][T17087] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 936.938607][T17087] RIP: 0033:0x7f081b31c819 [ 936.938629][T17087] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 936.938645][T17087] RSP: 002b:00007f0819576028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 936.938670][T17087] RAX: ffffffffffffffda RBX: 00007f081b595fa0 RCX: 00007f081b31c819 [ 936.938686][T17087] RDX: 04000000000003b4 RSI: 00002000000037c0 RDI: 0000000000000003 [ 936.938701][T17087] RBP: 00007f0819576090 R08: 0000200000003700 R09: 0000000000000000 [ 936.938716][T17087] R10: 0000000002040000 R11: 0000000000000246 R12: 0000000000000001 [ 936.938731][T17087] R13: 00007f081b596038 R14: 00007f081b595fa0 R15: 00007ffdeb87b3e8 [ 936.938766][T17087] [ 937.464521][ T5887] usb 6-1: USB disconnect, device number 58 [ 937.480824][ T6492] udevd[6492]: setting mode of /dev/bus/usb/006/058 to 020664 failed: No such file or directory [ 937.481016][ T6492] udevd[6492]: setting owner of /dev/bus/usb/006/058 to uid=0, gid=0 failed: No such file or directory [ 937.804366][T15472] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 937.861660][T16307] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 937.891322][T16314] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 937.956733][T15472] usb 4-1: Using ep0 maxpacket: 16 [ 937.973692][T15472] usb 4-1: config 0 interface 0 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 25 [ 937.973733][T15472] usb 4-1: config 0 interface 0 has no altsetting 0 [ 937.973768][T15472] usb 4-1: New USB device found, idVendor=146b, idProduct=0902, bcdDevice= 0.00 [ 937.973791][T15472] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 938.008647][T15472] usb 4-1: config 0 descriptor?? [ 938.431393][T15472] hid (null): invalid report_size 29797 [ 938.431443][T15472] hid (null): invalid report_size 29696 [ 938.447928][T15472] bigben 0003:146B:0902.0022: unexpected rdesc, please submit for review [ 938.448525][T15472] bigben 0003:146B:0902.0022: unknown main item tag 0x0 [ 938.448560][T15472] bigben 0003:146B:0902.0022: unknown main item tag 0x0 [ 938.448587][T15472] bigben 0003:146B:0902.0022: unknown main item tag 0x0 [ 938.448614][T15472] bigben 0003:146B:0902.0022: unknown main item tag 0x0 [ 938.448640][T15472] bigben 0003:146B:0902.0022: unknown main item tag 0x0 [ 938.448666][T15472] bigben 0003:146B:0902.0022: unknown main item tag 0x0 [ 938.448693][T15472] bigben 0003:146B:0902.0022: unknown main item tag 0x0 [ 938.448719][T15472] bigben 0003:146B:0902.0022: invalid report_size 29797 [ 938.448736][T15472] bigben 0003:146B:0902.0022: item 0 2 1 7 parsing failed [ 938.461963][T15472] bigben 0003:146B:0902.0022: parse failed [ 938.462072][T15472] bigben 0003:146B:0902.0022: probe with driver bigben failed with error -22 [ 938.465112][ T5887] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 938.650632][T16307] veth0_vlan: entered promiscuous mode [ 938.663761][ T9] usb 4-1: USB disconnect, device number 90 [ 938.674374][ T5887] usb 6-1: Using ep0 maxpacket: 16 [ 938.679729][ T5887] usb 6-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 938.679763][ T5887] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 938.679785][ T5887] usb 6-1: Product: syz [ 938.679801][ T5887] usb 6-1: Manufacturer: syz [ 938.679817][ T5887] usb 6-1: SerialNumber: syz [ 938.733318][T16307] veth1_vlan: entered promiscuous mode [ 938.776686][ T5887] usb 6-1: config 0 descriptor?? [ 938.830440][T17121] FAULT_INJECTION: forcing a failure. [ 938.830440][T17121] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 938.830485][T17121] CPU: 1 UID: 0 PID: 17121 Comm: syz.2.3740 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 938.830517][T17121] Tainted: [L]=SOFTLOCKUP [ 938.830526][T17121] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 938.830538][T17121] Call Trace: [ 938.830547][T17121] [ 938.830557][T17121] dump_stack_lvl+0xe8/0x150 [ 938.830597][T17121] should_fail_ex+0x46b/0x600 [ 938.830635][T17121] _copy_from_iter+0x1d3/0x1670 [ 938.830682][T17121] ? __pfx__copy_from_iter+0x10/0x10 [ 938.830734][T17121] file_tty_write+0x4ca/0xa30 [ 938.830777][T17121] vfs_write+0x629/0xba0 [ 938.830821][T17121] ? __pfx_vfs_write+0x10/0x10 [ 938.830865][T17121] ? __fget_files+0x2a/0x420 [ 938.830905][T17121] ksys_write+0x156/0x270 [ 938.830951][T17121] ? __pfx_ksys_write+0x10/0x10 [ 938.830999][T17121] do_syscall_64+0x14d/0xf80 [ 938.831021][T17121] ? trace_irq_disable+0x3b/0x150 [ 938.831048][T17121] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 938.831070][T17121] ? clear_bhb_loop+0x40/0x90 [ 938.831098][T17121] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 938.831121][T17121] RIP: 0033:0x7f66ae43c819 [ 938.831142][T17121] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 938.831161][T17121] RSP: 002b:00007f66ac696028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 938.831184][T17121] RAX: ffffffffffffffda RBX: 00007f66ae6b5fa0 RCX: 00007f66ae43c819 [ 938.831200][T17121] RDX: 0000000000001006 RSI: 0000200000004500 RDI: 0000000000000004 [ 938.831214][T17121] RBP: 00007f66ac696090 R08: 0000000000000000 R09: 0000000000000000 [ 938.831227][T17121] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 938.831240][T17121] R13: 00007f66ae6b6038 R14: 00007f66ae6b5fa0 R15: 00007fffeb0eacf8 [ 938.831280][T17121] [ 939.304454][ T5887] dvb_usb_dtv5100 6-1:0.0: probe with driver dvb_usb_dtv5100 failed with error -71 [ 939.314375][T15472] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 939.369933][ T5887] usb 6-1: USB disconnect, device number 59 [ 939.470926][T15472] usb 3-1: Using ep0 maxpacket: 8 [ 939.480557][T15472] usb 3-1: New USB device found, idVendor=0c45, idProduct=8003, bcdDevice=f9.64 [ 939.480584][T15472] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=67 [ 939.480597][T15472] usb 3-1: Product: syz [ 939.480607][T15472] usb 3-1: Manufacturer: syz [ 939.480622][T15472] usb 3-1: SerialNumber: syz [ 939.486495][T15472] usb 3-1: config 0 descriptor?? [ 939.529214][T15472] gspca_main: sn9c2028-2.14.0 probing 0c45:8003 [ 939.844801][T16307] veth0_macvtap: entered promiscuous mode [ 939.853543][T16307] veth1_macvtap: entered promiscuous mode [ 939.951409][T15472] gspca_sn9c2028: read1 error -71 [ 939.951830][T15472] gspca_sn9c2028: read1 error -71 [ 939.951934][T15472] sn9c2028 3-1:0.0: probe with driver sn9c2028 failed with error -71 [ 939.982152][T15472] usb 3-1: USB disconnect, device number 8 [ 940.268779][T16307] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 940.271298][T16314] veth0_vlan: entered promiscuous mode [ 940.303282][T16307] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 940.315252][ T37] audit: type=1400 audit(1775126209.570:2568): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=16 comm="ktimers/0" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=56918 netif=lo [ 940.358948][T16314] veth1_vlan: entered promiscuous mode [ 940.359983][ T1313] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 940.384884][T13173] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 940.437690][ T1313] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 940.441512][ T1313] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 940.469216][ T1313] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 940.514423][ T5913] usb 6-1: new high-speed USB device number 60 using dummy_hcd [ 940.534795][T13173] usb 4-1: Using ep0 maxpacket: 8 [ 940.539578][T13173] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 940.539611][T13173] usb 4-1: New USB device strings: Mfr=1, Product=0, SerialNumber=3 [ 940.539634][T13173] usb 4-1: Manufacturer: syz [ 940.539650][T13173] usb 4-1: SerialNumber: syz [ 940.563577][T13173] usb 4-1: config 0 descriptor?? [ 940.669531][ T5913] usb 6-1: unable to get BOS descriptor or descriptor too short [ 940.671090][ T5913] usb 6-1: config 1 has an invalid descriptor of length 216, skipping remainder of the config [ 940.671117][ T5913] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 940.703275][ T5913] usb 6-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 940.703311][ T5913] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 940.703333][ T5913] usb 6-1: Product: syz [ 940.703349][ T5913] usb 6-1: Manufacturer: syz [ 940.703366][ T5913] usb 6-1: SerialNumber: syz [ 940.964565][T13173] dvb_usb_rtl28xxu 4-1:0.0: chip type detection failed -71 [ 940.964682][T13173] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 940.991031][T13173] usb 4-1: USB disconnect, device number 91 [ 942.088512][ T5913] usb 6-1: USB disconnect, device number 60 [ 942.732731][T15744] hsr_slave_0: left promiscuous mode [ 942.774422][T15744] hsr_slave_1: left promiscuous mode [ 942.775725][T15744] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 942.775753][T15744] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 942.845494][T15744] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 942.845525][T15744] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 942.968999][T15744] veth1_macvtap: left promiscuous mode [ 942.969320][T15744] veth1_vlan: left promiscuous mode [ 942.969565][T15744] veth0_vlan: left promiscuous mode [ 944.397463][T15744] team0 (unregistering): Port device team_slave_1 removed [ 944.475282][T15744] team0 (unregistering): Port device team_slave_0 removed [ 944.874473][T16314] veth0_macvtap: entered promiscuous mode [ 945.064376][T16314] veth1_macvtap: entered promiscuous mode [ 945.093085][T15676] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 945.093110][T15676] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 945.397501][T16314] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 945.426266][ T37] audit: type=1400 audit(1775126214.680:2569): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=35022 netif=lo [ 945.426323][ T37] audit: type=1400 audit(1775126214.680:2570): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=35022 netif=lo [ 945.426370][ T37] audit: type=1400 audit(1775126214.680:2571): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=35022 netif=lo [ 945.426417][ T37] audit: type=1400 audit(1775126214.680:2572): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="?" object="_" requested=w pid=29 comm="ktimers/1" saddr=172.20.20.170 src=16385 daddr=172.20.20.170 dest=35022 netif=lo [ 945.477806][ T1313] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 945.477830][ T1313] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 945.480926][T16314] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 945.652956][ T158] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 945.697321][ T158] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 945.721757][ T158] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 945.745390][ T158] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 946.705375][ T38] INFO: task syz.0.3087:15225 blocked for more than 143 seconds. [ 946.705407][ T38] Tainted: G L syzkaller #0 [ 946.705420][ T38] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 946.705432][ T38] task:syz.0.3087 state:D stack:28672 pid:15225 tgid:1[ 946.705432][ T38] task:syz.0.3087 state:D stack:28672 pid:15225 tgid:15222 ppid:5802 task_flags:0x400140 flags:0x00080002 [ 946.705512][ T38] Call Trace: [ 946.705521][ T38] [ 946.705537][ T38] __schedule+0x1553/0x5240 [ 946.705596][ T38] ? trace_irq_disable+0x3b/0x150 [ 946.705630][ T38] ? __pfx___schedule+0x10/0x10 [ 946.705671][ T38] rt_mutex_schedule+0x76/0xf0 [ 946.705699][ T38] rt_mutex_slowlock_block+0x508/0x680 [ 946.705746][ T38] ? rt_mutex_slowlock_block+0x2e9/0x680 [ 946.705780][ T38] rt_mutex_slowlock+0x2dc/0x7b0 [ 946.705816][ T38] ? rt_mutex_slowlock+0x1fd/0x7b0 [ 946.705857][ T38] ? __pfx_rt_mutex_slowlock+0x10/0x10 [ 946.705911][ T38] ? lock_acquire+0x20b/0x2e0 [ 946.705939][ T38] ? bdev_open+0xe0/0xcc0 [ 946.705965][ T38] mutex_lock_nested+0x168/0x1d0 [ 946.706002][ T38] bdev_open+0xe0/0xcc0 [ 946.706042][ T38] bdev_file_open_by_dev+0x1be/0x240 [ 946.706075][ T38] setup_bdev_super+0x5a/0x5b0 [ 946.706114][ T38] get_tree_bdev_flags+0x389/0x4f0 [ 946.706151][ T38] ? __pfx_jfs_fill_super+0x10/0x10 [ 946.706179][ T38] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 946.706213][ T38] ? cap_capable+0x123/0x490 [ 946.706340][ T38] ? safesetid_security_capable+0xa9/0x1a0 [ 946.706375][ T38] vfs_get_tree+0x92/0x2a0 [ 946.706402][ T38] do_new_mount+0x341/0xd30 [ 946.706430][ T38] ? safesetid_security_capable+0xa9/0x1a0 [ 946.706459][ T38] ? __pfx_do_new_mount+0x10/0x10 [ 946.706488][ T38] ? ns_capable+0x89/0xe0 [ 946.706534][ T38] ? user_path_at+0xd4/0x160 [ 946.706569][ T38] __se_sys_mount+0x31d/0x420 [ 946.706607][ T38] ? __pfx___se_sys_mount+0x10/0x10 [ 946.706643][ T38] ? __x64_sys_mount+0x20/0xc0 [ 946.706676][ T38] do_syscall_64+0x14d/0xf80 [ 946.706699][ T38] ? trace_irq_disable+0x3b/0x150 [ 946.706725][ T38] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 946.706749][ T38] ? clear_bhb_loop+0x40/0x90 [ 946.706777][ T38] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 946.706799][ T38] RIP: 0033:0x7ffa074bc819 [ 946.706827][ T38] RSP: 002b:00007ffa056f5028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 946.706852][ T38] RAX: ffffffffffffffda RBX: 00007ffa07736090 RCX: 00007ffa074bc819 [ 946.706869][ T38] RDX: 0000200000000080 RSI: 0000200000000040 RDI: 0000200000000000 [ 946.706885][ T38] RBP: 00007ffa07552c91 R08: 0000000000000000 R09: 0000000000000000 [ 946.706900][ T38] R10: 0000000001a0c000 R11: 0000000000000246 R12: 0000000000000000 [ 946.706914][ T38] R13: 00007ffa07736128 R14: 00007ffa07736090 R15: 00007ffff878d2b8 [ 946.706953][ T38] [ 946.706987][ T38] [ 946.706987][ T38] Showing all locks held in the system: [ 946.706997][ T38] 2 locks held by kworker/0:0/9: [ 946.707012][ T38] 1 lock held by khungtaskd/38: [ 946.707024][ T38] #0: ffffffff8ddcb9c0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 946.707084][ T38] 4 locks held by kworker/u8:7/158: [ 946.707115][ T38] 2 locks held by getty/5563: [ 946.707127][ T38] #0: ffff8880327e60a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 946.707188][ T38] #1: ffffc90003e7e2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x462/0x13c0 [ 946.707243][ T38] 1 lock held by udevd/5804: [ 946.707255][ T38] #0: ffff888025cda4c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xcc0 [ 946.707312][ T38] 6 locks held by kworker/0:4/5887: [ 946.707325][ T38] #0: ffff8880222aa538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 [ 946.718956][ T38] #1: ffffc90005147c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 [ 946.719037][ T38] #2: ffff88802942a210 (&dev->mutex){....}-{4:4}, at: hub_event+0x17c/0x4f60 [ 946.719093][ T38] #3: ffff888029443640 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x21b0/0x4f60 [ 946.719150][ T38] #4: ffff88801f31f458 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x21e0/0x4f60 [ 946.719206][ T38] #5: ffffffff8e9fc840 (ehci_cf_port_reset_rwsem){.+.+}-{4:4}, at: hub_port_reset+0x14e/0x1820 [ 946.719265][ T38] 3 locks held by kworker/0:6/5913: [ 946.719279][ T38] 8 locks held by kworker/0:7/5947: [ 946.719300][ T38] 2 locks held by syz.0.3087/15225: [ 946.719325][ T38] #0: ffff88804b37a0d0 (&type->s_umount_key#95/1){+.+.}-{4:4}, at: alloc_super+0x28c/0xac0 [ 946.719395][ T38] #1: ffff888025cda4c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xcc0 [ 946.719454][ T38] 4 locks held by kworker/u8:19/15744: [ 946.719466][ T38] #0: ffff88801aee1138 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 [ 946.719624][ T38] #1: ffffc900046c7c40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 [ 946.719687][ T38] #2: ffffffff8f14e4c0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf4/0x800 [ 946.719739][ T38] #3: ffffffff8ddd1b70 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 946.719797][ T38] 3 locks held by syz-executor/16314: [ 946.719817][ T38] 2 locks held by syz.3.3771/17220: [ 946.719838][ T38] 3 locks held by dhcpcd-run-hook/17219: [ 946.719855][ T38] [ 946.719861][ T38] ============================================= [ 946.719861][ T38] [ 946.719872][ T38] NMI backtrace for cpu 0 [ 946.719891][ T38] CPU: 0 UID: 0 PID: 38 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 946.719921][ T38] Tainted: [L]=SOFTLOCKUP [ 946.719930][ T38] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 946.719943][ T38] Call Trace: [ 946.719952][ T38] [ 946.719961][ T38] dump_stack_lvl+0xe8/0x150 [ 946.719997][ T38] nmi_cpu_backtrace+0x274/0x2d0 [ 946.720027][ T38] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 946.720062][ T38] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 946.720094][ T38] sys_info+0x135/0x170 [ 946.720121][ T38] watchdog+0xfd9/0x1030 [ 946.720154][ T38] ? watchdog+0x21a/0x1030 [ 946.720190][ T38] kthread+0x388/0x470 [ 946.720214][ T38] ? __pfx_watchdog+0x10/0x10 [ 946.720238][ T38] ? __pfx_kthread+0x10/0x10 [ 946.720264][ T38] ret_from_fork+0x51e/0xb90 [ 946.720299][ T38] ? __pfx_ret_from_fork+0x10/0x10 [ 946.720328][ T38] ? __switch_to+0xc7d/0x1450 [ 946.720361][ T38] ? __pfx_kthread+0x10/0x10 [ 946.720386][ T38] ret_from_fork_asm+0x1a/0x30 [ 946.720425][ T38] [ 946.720434][ T38] Sending NMI from CPU 0 to CPUs 1: [ 946.720464][ C1] NMI backtrace for cpu 1 [ 946.720482][ C1] CPU: 1 UID: 0 PID: 17196 Comm: syz.5.3762 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 946.720507][ C1] Tainted: [L]=SOFTLOCKUP [ 946.720513][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 946.720524][ C1] RIP: 0010:unwind_next_frame+0x5d/0x23c0 [ 946.720545][ C1] Code: 3c 28 00 74 08 48 89 df e8 90 2a b4 00 48 89 5c 24 10 49 8b 5e 48 4d 8d 6e 38 4c 89 e8 48 c1 e8 03 48 89 44 24 58 80 3c 28 00 <74> 08 4c 89 ef e8 69 2a b4 00 4d 8b 7e 38 4d 89 f4 49 c1 ec 03 41 [ 946.720561][ C1] RSP: 0018:ffffc90004f26d78 EFLAGS: 00000246 [ 946.720578][ C1] RAX: 1ffff920009e4dd0 RBX: ffffffff8208d140 RCX: 0000000000000000 [ 946.720591][ C1] RDX: dffffc0000000000 RSI: ffffffff8208d140 RDI: ffffc90004f26e48 [ 946.720604][ C1] RBP: dffffc0000000000 R08: ffffc90004f26f10 R09: 0000000000000003 [ 946.720616][ C1] R10: ffffc90004f26e98 R11: ffffffff81af9290 R12: ffff888028805b80 [ 946.720629][ C1] R13: ffffc90004f26e80 R14: ffffc90004f26e48 R15: ffffc90004f26e48 [ 946.720642][ C1] FS: 0000000000000000(0000) GS:ffff888126436000(0000) knlGS:0000000000000000 [ 946.720657][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 946.720670][ C1] CR2: 00007fac1f195980 CR3: 0000000039520000 CR4: 00000000003526f0 [ 946.720689][ C1] DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000002 [ 946.720702][ C1] DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 946.720714][ C1] Call Trace: [ 946.720721][ C1] [ 946.720732][ C1] ? unwind_next_frame+0xa5/0x23c0 [ 946.720750][ C1] ? shmem_undo_range+0x52c/0x1660 [ 946.720776][ C1] ? shmem_evict_inode+0x240/0x9e0 [ 946.720796][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 946.720819][ C1] arch_stack_walk+0x11b/0x150 [ 946.720840][ C1] ? shmem_evict_inode+0x240/0x9e0 [ 946.720861][ C1] stack_trace_save+0xa9/0x100 [ 946.720884][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 946.720907][ C1] ? stack_depot_save_flags+0x33/0x810 [ 946.720932][ C1] save_stack+0x124/0x230 [ 946.720959][ C1] ? __pfx_save_stack+0x10/0x10 [ 946.720983][ C1] ? free_unref_folios+0xe7b/0x1c70 [ 946.720999][ C1] ? folios_put_refs+0x56f/0x680 [ 946.721016][ C1] ? shmem_undo_range+0x52c/0x1660 [ 946.721040][ C1] ? shmem_evict_inode+0x240/0x9e0 [ 946.721064][ C1] ? page_ext_put+0x97/0xc0 [ 946.721100][ C1] __reset_page_owner+0x71/0x1f0 [ 946.721127][ C1] free_unref_folios+0xe7b/0x1c70 [ 946.721151][ C1] folios_put_refs+0x56f/0x680 [ 946.721173][ C1] ? __pfx_folios_put_refs+0x10/0x10 [ 946.721192][ C1] ? folio_batch_remove_exceptionals+0x18c/0x1f0 [ 946.721214][ C1] shmem_undo_range+0x52c/0x1660 [ 946.721243][ C1] ? __lock_acquire+0x6b5/0x2cf0 [ 946.721262][ C1] ? __pfx_shmem_undo_range+0x10/0x10 [ 946.721300][ C1] ? rtlock_slowlock_locked+0xfb/0x3c80 [ 946.721335][ C1] ? __lock_acquire+0x6b5/0x2cf0 [ 946.721353][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 946.721376][ C1] ? percpu_counter_add_batch+0xea/0x1d0 [ 946.721401][ C1] shmem_evict_inode+0x240/0x9e0 [ 946.721420][ C1] ? lockdep_hardirqs_on+0x7a/0x110 [ 946.721438][ C1] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 946.721457][ C1] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 946.721480][ C1] ? __pfx_shmem_evict_inode+0x10/0x10 [ 946.721502][ C1] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 946.721526][ C1] ? rt_spin_unlock+0x14f/0x200 [ 946.721550][ C1] ? rt_spin_unlock+0x160/0x200 [ 946.721572][ C1] ? __pfx_shmem_evict_inode+0x10/0x10 [ 946.721592][ C1] evict+0x61e/0xb10 [ 946.721610][ C1] ? rt_spin_unlock+0x14f/0x200 [ 946.721633][ C1] ? __pfx_evict+0x10/0x10 [ 946.721650][ C1] ? rt_spin_unlock+0x160/0x200 [ 946.721673][ C1] ? iput+0xb25/0xe80 [ 946.721699][ C1] __dentry_kill+0x1a2/0x5e0 [ 946.721718][ C1] ? finish_dput+0xad/0x480 [ 946.721738][ C1] finish_dput+0xc9/0x480 [ 946.721761][ C1] __fput+0x6a3/0xa90 [ 946.721787][ C1] task_work_run+0x1d9/0x270 [ 946.721808][ C1] ? __pfx_task_work_run+0x10/0x10 [ 946.721827][ C1] ? kmem_cache_free+0x185/0x6b0 [ 946.721844][ C1] ? put_net+0x191/0x260 [ 946.721868][ C1] do_exit+0x70f/0x23c0 [ 946.721887][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 946.721907][ C1] ? __pfx_do_exit+0x10/0x10 [ 946.721924][ C1] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 946.721947][ C1] ? reacquire_held_locks+0x104/0x190 [ 946.721965][ C1] ? rt_spin_lock+0x1e0/0x400 [ 946.721993][ C1] do_group_exit+0x21b/0x2d0 [ 946.722011][ C1] ? rt_spin_unlock+0x160/0x200 [ 946.722035][ C1] get_signal+0x125c/0x1310 [ 946.722074][ C1] arch_do_signal_or_restart+0xbc/0x830 [ 946.722097][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 946.722127][ C1] exit_to_user_mode_loop+0x86/0x480 [ 946.722151][ C1] ? rcu_is_watching+0x15/0xb0 [ 946.722172][ C1] do_syscall_64+0x32d/0xf80 [ 946.722190][ C1] ? trace_irq_disable+0x3b/0x150 [ 946.722210][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 946.722227][ C1] ? clear_bhb_loop+0x40/0x90 [ 946.722247][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 946.722264][ C1] RIP: 0033:0x7fcda5ebc819 [ 946.722279][ C1] Code: Unable to access opcode bytes at 0x7fcda5ebc7ef. [ 946.722289][ C1] RSP: 002b:00007fcda40ed0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 946.722307][ C1] RAX: fffffffffffffe00 RBX: 00007fcda6136098 RCX: 00007fcda5ebc819 [ 946.722320][ C1] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fcda6136098 [ 946.722332][ C1] RBP: 00007fcda6136090 R08: 0000000000000000 R09: 0000000000000000 [ 946.722343][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 946.722354][ C1] R13: 00007fcda6136128 R14: 00007fff9a757f30 R15: 00007fff9a758018 [ 946.722375][ C1] [ 946.734365][ T5887] usb 2-1: new high-speed USB device number 76 using dummy_hcd [ 946.804233][ T38] Kernel panic - not syncing: hung_task: blocked tasks [ 946.804262][ T38] CPU: 0 UID: 0 PID: 38 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 946.804293][ T38] Tainted: [L]=SOFTLOCKUP [ 946.804300][ T38] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 946.804313][ T38] Call Trace: [ 946.804322][ T38] [ 946.804333][ T38] vpanic+0x56c/0xa60 [ 946.804371][ T38] ? __pfx___schedule+0x10/0x10 [ 946.804395][ T38] ? __pfx_vpanic+0x10/0x10 [ 946.804434][ T38] panic+0xc5/0xd0 [ 946.804463][ T38] ? __pfx_panic+0x10/0x10 [ 946.804495][ T38] ? preempt_schedule_thunk+0x16/0x30 [ 946.804527][ T38] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 946.804560][ T38] watchdog+0x1023/0x1030 [ 946.804588][ T38] ? watchdog+0x21a/0x1030 [ 946.804617][ T38] kthread+0x388/0x470 [ 946.804638][ T38] ? __pfx_watchdog+0x10/0x10 [ 946.804659][ T38] ? __pfx_kthread+0x10/0x10 [ 946.804680][ T38] ret_from_fork+0x51e/0xb90 [ 946.804708][ T38] ? __pfx_ret_from_fork+0x10/0x10 [ 946.804731][ T38] ? __switch_to+0xc7d/0x1450 [ 946.804757][ T38] ? __pfx_kthread+0x10/0x10 [ 946.804778][ T38] ret_from_fork_asm+0x1a/0x30 [ 946.804819][ T38] [ 946.805529][ T38] Kernel Offset: disabled