last executing test programs: 8m13.887225953s ago: executing program 3 (id=1202): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GCALLUSERDATA(r3, 0x89e4, &(0x7f00000000c0)={0x18, "978dee3d454045a4956b8749086a8879f8567e120a1573fa402af64aee6565ea97227ee0a0997013ca35fd1cad8957ee6797d3b338555a1c30a0ae4e7713237c4029cb71052987a3db7f02088ee46e53454950f9425b69b133daa522d572f467bd7ff1f5fe8302bd8b4353876636bc7d2a0c7b064784ff09c99b25664f745f58"}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000240), 0x40900, 0x0) r5 = syz_io_uring_setup(0x494, &(0x7f0000000180)={0x0, 0x191d, 0x8, 0x8000, 0x40000250}, &(0x7f0000000080)=0x0, &(0x7f0000000400)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f0000000040)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x0, @fd=r4, 0x8006, &(0x7f0000000300)=""/210, 0xd2, 0x2, 0x1}) io_uring_enter(r5, 0x4be7, 0x4c3, 0x43, 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_submit(r10, 0x2, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, r8, 0x0, 0x0, 0x0, 0x0, 0x2, r9}, &(0x7f0000000100)={0x0, 0x0, 0x8, 0x0, 0x0, r9, 0x0, 0x0, 0x0, 0x0, 0x0, r8}]) ioctl$VIDIOC_QUERYSTD(r9, 0x8008563f, &(0x7f0000000200)) 8m12.268564571s ago: executing program 3 (id=1209): socket$netlink(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8005, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[], 0x118}}, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r3, r3, 0x0, 0x20f4ff) cachestat(r3, &(0x7f0000000000)={0x9}, &(0x7f0000000040), 0x0) 8m10.087032828s ago: executing program 3 (id=1219): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000100), r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a30000000003c000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a30000000000800054000000002580000000e0a01020000000000000000010000000900020073797a32000000001800038014000080100001800600028006000180000000000900010073797a30"], 0xc8}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000003780)={&(0x7f0000000e00)=@newtaction={0x488, 0x30, 0x12f, 0x3c, 0x0, {}, [{0x474, 0x1, [@m_police={0x470, 0x1, 0x0, 0x0, {{0xb}, {0x444, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0xffffffff, 0x0, 0x0, 0x4, 0x0, 0xb, 0x4, 0x0, 0x8d, 0x0, 0x7ff, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xa4f, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x1000, 0x10, 0xfffffffd, 0x3, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xb4, 0x0, 0x0, 0x1, 0x8000000, 0x0, 0x0, 0x11, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0xfffffff8, 0x0, 0x0, 0x3, 0xb2e4, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x100, 0x0, 0x3, 0x1, 0x0, 0x0, 0x0, 0x0, 0x934, 0x7, 0x0, 0x7, 0x0, 0x0, 0x0, 0x9, 0x0, 0x10000000, 0x0, 0x7, 0x0, 0x81, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x7, 0x3, 0x8, 0xfffffffe, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0xffff3bac, 0xd, 0x2, 0x2000, 0x3, 0x0, 0x0, 0xfffffffe, 0xffffffd1, 0x480000, 0x0, 0x0, 0x6, 0x5, 0x0, 0x0, 0x0, 0x0, 0x9a3, 0x0, 0x6, 0x7ff, 0x4, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x713b, 0x0, 0x0, 0x0, 0xffff, 0x1000000, 0xffffffff, 0x2, 0xfffffffd, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xce2, 0x0, 0x0, 0x0, 0x400000, 0x0, 0x2000000, 0xfffffff9, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10002, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x10000000, 0x7, 0xff, 0x0, 0x7]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x1, 0x0, 0x0, 0x0, {0x3, 0x0, 0x0, 0x0, 0x3, 0xbed}, {0x0, 0xf6c5d7a4e5a498ca, 0x1000, 0x8}}}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa, {0x0, 0x3}}}}]}]}, 0x488}, 0x1, 0x0, 0x0, 0x4044840}, 0x44004) r4 = open(&(0x7f0000000040)='./file2\x00', 0x1, 0x104) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x101040) ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r5, 0x54a2) ioctl$BTRFS_IOC_DEFRAG(r4, 0x40081271, 0x3) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f00000002c0)={0x1, @pix_mp={0x5, 0x4, 0x38303553, 0x1, 0xb, [{0x401, 0x8}, {0x3, 0x6}, {0x7, 0x7}, {0x2}, {0x2, 0x1800000}, {0x80, 0x8001}, {0x6, 0xd5}, {0x1, 0xd}], 0x4, 0x2, 0x2, 0x0, 0x3}}) prctl$PR_SET_IO_FLUSHER(0x41, 0x3) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000004700)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x74, r6, {0x0, 0xd}, {0x5}, {0x8, 0x5}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x8881}, 0x0) 8m9.134749701s ago: executing program 3 (id=1224): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x23e9c9e, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) unshare(0x24020400) mount$bind(&(0x7f0000000280)='./file0/../file0\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x28a5291, 0x8cffffffffffffff) 8m8.914760701s ago: executing program 3 (id=1225): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, 0x0, &(0x7f0000000300)='GPL\x00', 0x2, 0xb3, &(0x7f0000000140)=""/179, 0x41100, 0x7b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x38}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000600)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast6-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x4dc8aa39}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe0b5bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2, 0x0, 0xf0ff}, 0x0) 8m7.454784229s ago: executing program 3 (id=1234): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$nci(r0, &(0x7f0000000340)=@NCI_OP_CORE_INIT_RSP, 0x14) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0xd4, 0x0, &(0x7f0000000600)=[@dead_binder_done, @request_death={0x400c630e, 0x1}, @free_buffer, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x12, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000540)={@ptr={0x70742a85, 0x1, &(0x7f00000004c0)=""/99, 0x63, 0x0, 0x3d}, @flat=@weak_handle={0x77682a85, 0x200b, 0x2}, @fd={0x66642a85, 0x0, r0}}, &(0x7f00000000c0)={0x0, 0x28, 0x40}}}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x1, 0x2}, @flat=@handle={0x73682a85, 0x1, 0x1}, @fda={0x66646185, 0x6, 0x2, 0x2a}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}, 0x40}, @acquire={0x40046305, 0x1}, @exit_looper, @request_death={0x400c630e, 0x1}], 0x7f, 0x0, &(0x7f0000000280)="ded6504c4b374f10d8cd58fa3d9ae0957d942da5a76700732c6db552251e0a5d77f635f73c7a7f9911465c2822655c7d64c393bb52b97e7113a161131615178b6b098f2d7297e47aa99a6d2781f6e0319d67f426914ee58245ffeb2c01ae318157187f6f461dc9674b4660a07e5f076718b9f326f75277036420286eed57d5"}) syz_emit_ethernet(0x3d, &(0x7f00000005c0)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x31}, @void, {@llc_tr={0x11, {@snap={0xaa, 0xab, '\x00', "d91980", 0x809b, "678d2cb56397c3192167a495fe5629db2f987c17fb414291c8fa6ec212110a08880596bad4211f"}}}}}, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000480)='/sys/kernel/cpu_byteorder', 0x0, 0x10) r2 = socket$unix(0x1, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0x10, &(0x7f0000000000)=0x2, 0x4) connect$unix(r2, &(0x7f00000004c0)=@file={0x1, './file0\x00'}, 0x6e) r3 = syz_open_dev$cec(&(0x7f0000000000), 0xffffffffffffffff, 0xc0c00) ioctl$CEC_DQEVENT(r3, 0xc0506107, &(0x7f0000002100)={0x0, 0x0, 0x0, @raw}) lsetxattr$security_selinux(&(0x7f00000001c0)='.\x00', &(0x7f0000000200), &(0x7f0000000280)='system_u:object_r:systemd_passwd_var_run_t:s0\x00', 0x2e, 0x2) process_mrelease(r1, 0x0) 8m6.493641236s ago: executing program 32 (id=1234): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$nci(r0, &(0x7f0000000340)=@NCI_OP_CORE_INIT_RSP, 0x14) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0xd4, 0x0, &(0x7f0000000600)=[@dead_binder_done, @request_death={0x400c630e, 0x1}, @free_buffer, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x12, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000540)={@ptr={0x70742a85, 0x1, &(0x7f00000004c0)=""/99, 0x63, 0x0, 0x3d}, @flat=@weak_handle={0x77682a85, 0x200b, 0x2}, @fd={0x66642a85, 0x0, r0}}, &(0x7f00000000c0)={0x0, 0x28, 0x40}}}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x1, 0x2}, @flat=@handle={0x73682a85, 0x1, 0x1}, @fda={0x66646185, 0x6, 0x2, 0x2a}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}, 0x40}, @acquire={0x40046305, 0x1}, @exit_looper, @request_death={0x400c630e, 0x1}], 0x7f, 0x0, &(0x7f0000000280)="ded6504c4b374f10d8cd58fa3d9ae0957d942da5a76700732c6db552251e0a5d77f635f73c7a7f9911465c2822655c7d64c393bb52b97e7113a161131615178b6b098f2d7297e47aa99a6d2781f6e0319d67f426914ee58245ffeb2c01ae318157187f6f461dc9674b4660a07e5f076718b9f326f75277036420286eed57d5"}) syz_emit_ethernet(0x3d, &(0x7f00000005c0)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x31}, @void, {@llc_tr={0x11, {@snap={0xaa, 0xab, '\x00', "d91980", 0x809b, "678d2cb56397c3192167a495fe5629db2f987c17fb414291c8fa6ec212110a08880596bad4211f"}}}}}, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000480)='/sys/kernel/cpu_byteorder', 0x0, 0x10) r2 = socket$unix(0x1, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0x10, &(0x7f0000000000)=0x2, 0x4) connect$unix(r2, &(0x7f00000004c0)=@file={0x1, './file0\x00'}, 0x6e) r3 = syz_open_dev$cec(&(0x7f0000000000), 0xffffffffffffffff, 0xc0c00) ioctl$CEC_DQEVENT(r3, 0xc0506107, &(0x7f0000002100)={0x0, 0x0, 0x0, @raw}) lsetxattr$security_selinux(&(0x7f00000001c0)='.\x00', &(0x7f0000000200), &(0x7f0000000280)='system_u:object_r:systemd_passwd_var_run_t:s0\x00', 0x2e, 0x2) process_mrelease(r1, 0x0) 5m32.59701949s ago: executing program 1 (id=1748): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0e000000040000000400000003"], 0x48) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000740)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001200)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000700)={0x20, 0x0, 0x4, {0x4}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0x4, {0x1}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000011c0)={0x2c, &(0x7f0000000fc0)=ANY=[@ANYBLOB="201b07000000a2313f"], 0x0, 0x0, 0x0, 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r3, &(0x7f0000000100), 0x208e24b) syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) preadv(r3, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) socket$l2tp6(0xa, 0x2, 0x73) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="640000001000370403000000ffffff"], 0x64}, 0x1, 0x0, 0x0, 0x48810}, 0x4000010) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004840}, 0x14) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) pipe2$9p(&(0x7f0000000080), 0x4800) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ff}, 0x94) ioctl$KVM_RUN(r5, 0xae80, 0x0) 5m27.040392717s ago: executing program 1 (id=1764): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000800), r0) r1 = syz_usb_connect$lan78xx(0x5, 0x0, 0x0, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bind$nfc_llcp(r2, &(0x7f0000001040)={0x27, 0x0, 0xffffffffffffffff, 0x5, 0xff, 0x0, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000e5ff00f2170e65e3f50327e422000000000000000200800000001100", 0x39}, 0x60) setpriority(0x2, 0x0, 0xc) close(r2) 5m23.106428718s ago: executing program 1 (id=1779): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = socket(0x10, 0x803, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket(0x10, 0x803, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000080), 0xa, 0x0) read(r2, &(0x7f0000000000)=""/34, 0x22) ioctl$DRM_IOCTL_SET_VERSION(r2, 0xc0106407, &(0x7f0000000400)={0x9, 0xfffffff8, 0x5, 0x2}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000380)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000180)={'batadv_slave_0\x00', 0x0}) setsockopt$packet_add_memb(r6, 0x107, 0x1, &(0x7f0000000000)={r7, 0x1, 0x0, @local}, 0x10) setsockopt$packet_add_memb(r6, 0x107, 0x1, &(0x7f00000000c0)={r7, 0x1, 0x6}, 0x10) ioctl$DRM_IOCTL_GET_UNIQUE(r2, 0xc0106401, 0x0) r8 = socket(0x2d, 0x2, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r2, 0xc00c642d, &(0x7f0000000180)={0x0, 0x80000, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r9, 0xc04064a0, &(0x7f0000000240)={&(0x7f0000000040), &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0], &(0x7f0000000680), 0x0, 0x5, 0x400000000000015a, 0xa}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r8, 0x89fb, &(0x7f0000000700)={'sit0\x00', &(0x7f00000001c0)={@private0, @multicast1, 0x6, 0x4}}) r10 = socket(0x1, 0x2, 0x0) getsockopt$sock_cred(r10, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r11, 0x0) 5m21.11579906s ago: executing program 1 (id=1785): openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x22102, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./file0\x00', 0x3a) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000002200), 0x1000080, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x2002) write$evdev(r0, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000000)='./file0/../file0/../file0/../file0/file0\x00') r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r1) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r1, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="080025bd7000fbdbdf250c000100000000000000000005002a0000000000"], 0x24}, 0x1, 0x0, 0x0, 0x4400c}, 0x90) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9101) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) pivot_root(&(0x7f00000000c0)='./file0/../file0/../file0/../file0/file0\x00', &(0x7f00000001c0)='./file0/../file0/../file0/../file0/file0\x00') r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x3) ioctl$KVM_GET_REG_LIST(r5, 0xc008aeb0, &(0x7f00000008c0)) 5m21.020722851s ago: executing program 1 (id=1788): r0 = dup(0xffffffffffffffff) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f00000000c0)=[@in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x22}}], 0x10) sendmsg$inet6(0xffffffffffffffff, 0x0, 0x4048043) socket$netlink(0x10, 0x3, 0x4) socket$nl_xfrm(0x10, 0x3, 0x6) socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x932, &(0x7f00000006c0)=ANY=[@ANYBLOB="1201100146d9de10b40b820a47520102030109022009020808b08b0904fb050ddc9cb0010a2401ffff040201020b240806060001dd60440c092406010101050004090500020800034000f50ed5ef5fd173d091591168e87250c4c3aec47660f1597fd83474cb9655a5c6ac06cabc81876731fcd19f7b07199dca2f13088b19e9cca44b6c127bc1285afea1baf400d83407081e84cb8e2a611f978d87b0eb5f0fb8efe24d536826ff7dc41aa8a413a7ea614f057fa73ef4a34431468b39b649d12de375f913eb26e2033696b7c9d04f0af792200ddaf77b157b9c39c975f20213e37b709e427fe3094c867fe37d27a5ca295ae08b3a71db95a28ba4c613b27fa3d2a618e8d1b1f17722a4069b4bf1c148ba640ca711f9ffeb0ce5139ead642c9012362636812723f7f4e459cd9b1351c87d37863d2d41d0c44f66ef13b82ac7090508024000020509072501830606001f0a6c0784ce332b534b699b21228de708a2dfc7a6b3e86218c0fced9a45c80905010e04000702030725010012f7ffdc102b19b35fcb626cc269084ee643d41c8de2d8b5eff57f87ac4ff4d0ee54f088235d683434bd75df6a721ca6024fcce2d0c3fc1d5d97e2bf0704f4d47f7c9655b293a027505c7e1edad8ca5348ac88a5ff4b6dad31e937bc105780a5c831b0f364851a7e71130c812b8aad6a65ba79d8b7f547bc9a5661850839fe5982be4f5dee9b7b55a65c67082cc55135f40c9ca07db1eb8284cfd8fb6df732d174b660fc1f6a83eada8d9c4df72ab036c19aca18160fae299794ff079ff867176092cb8e4cd7f3332f2bd85e42eb33e29475260905060f000400a81e07250101ffff07f909fac546bd0f088379e5f59dbcbda5cf868ee7d3a17a1fcb719e8665405c7995d30903b92ba65298f9bb14a240464bc06c2070eaaf2d15f384428f3bfdcd6dfcd94e451055f04da8ae0dd051c01de45e4c7ecfde186d8cce842a0fd44a4b440709c2fa438c4ea54873ee4063fe99209cafd7a4e86da9a7c6cce0c6c5cee4c67ede34a5a8b12caa51ebb4688a8f4d7dc73d302ce8514e394727698d361bfd28f19a57164ec09951b56aff10cefacaa849c1fb0956fd2f557f61e5524d767fd0257ac2170bc60552ab6c8fded83238b0ecd167acb7ebff4ccd1ad4f82cb8bae04b3b32136dca3ca4541994023f21ffe5c1313a12b57ba76ab3a6d359def9433ff8b8c58060e85d17585aee09050910ff0307984007250188ff09000725010102810009050302ff030005f90725010181080007250180ed00000905050cff030402f409050d1a080007070909050d100800890508072501020100000905080cff030909ff07250181fe0f00072501017fd00209050a0300040e067fef30e38b75cd8af4bf2a35407345db89234d70818e3edc425f5ac68038eff9dbf86b8de70ce4f47e2e4a65a6675f5e38fbfb6e082973a413666de6394cc623f0d3a913d44d119156107633e95f34b232fde25548da795fba9965744822944fdfe3a316206a5a54358293d431b31ee60888acbd01e98df72ed789f391c0d99aa9e3b548abbd5a0b2a7e3ff37447fd9ecf204c84b3c04febab72a0e858dbe2e56a4b375135031f3c9c3fa096c67784256e509723911bf6b796214be4f2db2290a68ff0ae440fef6bb9cf443c55ed59836e62e95672f8440ba813cf7f4fcd5e760f22f31d8d9ce550fc80c34c09050600ff0304d6cf072501030603000905030208009e03040904640310e544a10809050b1020000afd743a0df493c9e47039337b23a6ddb3da3d9053dc2eb6791ba62bbb852c43a6ddf0e51bfdb863efbf24a95852d7121d3d540c95b46363c3a644c90afc07af7db1d3fc56b402606b349e101aa9323ca13c973f49048537a52da3f3a4a6dc95a00118743ca0576328a1bd6852d3a31cc76aacdf0e8a7c0af660ee5d97f42667c51a391f1b4929142777f21fd9bc225ee8edfa5511ac042d6b71adb015a074696f1e2941b7becf9369ddca93c6d4127ec0384955a0d3765b0476ae33084f5104ad0a484304be63b9848f272b9ad14426e296ba66bd264ef0d92e0c6bdc9cbf02e3cdacc784182a30873f6ca24edec1affb9139678e914cf65a3ba1f67a8cd259ef58a7e20c4cb994f4200d284d3d533017839d8e830e818db4fdee290e26f0888e61b35b71ee0635e4e7dd0c513907af4d974693d64514b2a609050704ef030ea202090589000004ff070107250180fb0800090501002000000400072501800b00040905021d0002060202a222b5f3666de0b36999e2a04e98feb20b5c4dac9aa0a955a0164b4b5d3766a75ebbdaf5a34a75cb2e331008764af7639903422d6f3c95123bbef04897f1d3e7abd02552227b1c0b17df60820a2f008496bf3e66e79eecf77ea2a92097cebcc026193a2070ef6e566c1fe7548d030f7f81f2186860b38bfa4dd0e06db802a4b2f8c4a1d29af8e93aa376a7773426fa0f302dd78b2173331acf94231fb44c10b222440905070000020003fb09050f1010000005080905060300041007010905061010000705030905020000021a0109072501815d0c00072501030181f809058000200004cf37072501820304000905040320000306ff07250181040300d53121a8d926ff1e6c222607f36fc5572971085bc247240e11509d880fd31674ffc73f275093fc16998236fc2990eeafd81c54905f6d90a1f2fc97ea218d2d19c2d8300b5c5a11e1f9f79f1de6e4b02b7e0a0e2cae94130020f55343c33c136455a5b046d6049610f4f5a7805706d47fac76f0adddaafd6102ca45b301363eb3eaafd8c3d091f39f93f871352a51718846a886a062c9861667387bec38897d5674e0837e14c23bf927d0ba72bf4a4492ef03f7e5a8618c18f793493309c528519be3ff18d376f2888af2f3b2a1b895894ec1edc3e809050410ff030cf70b040bacad3e1c02353f5f0c740be047a2e9562cf5f7449a3b0e3f597a4825556c746a695c6bcc3f13cda443183145637faf4ab231c1554594c2e343f6da507cb86f98090502000000ff0707090508004000010c04072501800703000905051c2000058180072501020f0002972491ba901c9cc25626043ea2378d4d32d1caee9ed0120cebd96d64a30750b371f9ca0704b5981b70b12af7397508e842544b7fed5648ea1c3e956d59a567aa7636ae81de2e9ef008f379b34f9032db6868f4987e09491433f01fa4ef83f9435ea24c708ebc4fe2194686839ce2c2ea109006a445d7b59119d7de4bce0e780011ad621f037601f67be386ff2f8404ceb222ca50"], &(0x7f0000000280)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x200, 0x7, 0x95, 0x80, 0x40, 0x1a}, 0x34, &(0x7f0000000400)=ANY=[@ANYBLOB="050f3400050710020668d8f003100b18100a80030002000f0f090030400100003f0000cf00000003100b0a10030209000008b12bb544d5d123ed4d02dcbc7bd6fa7e2f596cf8"], 0x2, [{0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x44d}}, {0x22, &(0x7f0000000240)=@string={0x22, 0x3, "7c5fdecbdb97b5bc77757079c79c1564ae7466ba56d9198ccca98e5048220d29"}}]}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x0, 0x4, 0x8001, 0x0, 0xb49, 0x200000000002, 0x7, 0x8, 0x5}, 0x0) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) r4 = socket$netlink(0x10, 0x3, 0x9) writev(r4, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17", 0x2b}], 0x1) recvmmsg(r4, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x40010000, 0x0) syz_emit_ethernet(0x74, &(0x7f0000000000)=ANY=[@ANYBLOB="0180c200005fcdd4ce00000000000000080045000024000000000073907800000300e000000100000000fe9a"], 0x0) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f00000002c0)=0x3) mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000240)=ANY=[]) socket(0x10, 0x803, 0x0) syz_emit_ethernet(0x86, &(0x7f0000000300)=ANY=[@ANYBLOB="ffffffffffffbbbbbbbbbbbb08004500007800000000000190780a010102ac1414aa03049078010000004712a84e2a0114e2a27f00000000000000001100000000000000000000440c0001ac1414bb4e210000443c0001ac1414aa000000000000000000000000ac1414000000000000000000000000000000000000000000ac1e0001000000c2856f565c7afb124c5dd88fea9e33009c465347060d6614f363570c295dd2a96dd01da3e349"], 0x0) r5 = fcntl$getown(r3, 0x9) sched_setscheduler(r5, 0x3, &(0x7f0000000140)=0x7) 5m16.031190366s ago: executing program 1 (id=1800): r0 = syz_io_uring_setup(0x487, &(0x7f0000000240)={0x0, 0x59c4, 0x800, 0x1000, 0x5cc}, &(0x7f0000000300), &(0x7f0000000080)) r1 = memfd_secret(0x80000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x13, r1, 0x0) ftruncate(r1, 0x3) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x2500000000000000, &(0x7f0000000740)=[{&(0x7f00000003c0)=""/201, 0xc9}], 0x1) 5m14.935691559s ago: executing program 33 (id=1800): r0 = syz_io_uring_setup(0x487, &(0x7f0000000240)={0x0, 0x59c4, 0x800, 0x1000, 0x5cc}, &(0x7f0000000300), &(0x7f0000000080)) r1 = memfd_secret(0x80000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x13, r1, 0x0) ftruncate(r1, 0x3) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x2500000000000000, &(0x7f0000000740)=[{&(0x7f00000003c0)=""/201, 0xc9}], 0x1) 2m42.673332994s ago: executing program 0 (id=2296): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000800), r0) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, 0x0) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bind$nfc_llcp(r1, &(0x7f0000001040)={0x27, 0x0, 0xffffffffffffffff, 0x5, 0xff, 0x0, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000e5ff00f2170e65e3f50327e422000000000000000200800000001100", 0x39}, 0x60) setpriority(0x2, 0x0, 0xc) close(r1) 2m40.081954291s ago: executing program 0 (id=2307): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r0) sendmsg$DEVLINK_CMD_RATE_GET(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0xb0, r2, 0x200, 0x70bd2c, 0x25dfdbfc, {}, [@handle=@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @handle=@pci={{0x8}, {0x11}}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @handle=@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_PORT_INDEX={0x8}]}, 0xb0}, 0x1, 0x0, 0x0, 0x850}, 0x4000000) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r1) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r3, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x30, r4, 0x10, 0x70bd2a, 0x25dfdbfc, {{}, {}, {0x14, 0x19, {0xf11, 0x6, 0x8001, 0x4}}}, [""]}, 0x30}}, 0x4000880) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REQ_SET_REG(r5, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, 0x0, 0x2, 0x70bd28, 0x25dfdbfb, {}, [@NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x24040040}, 0x24000840) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), r1) sendmsg$NL80211_CMD_RADAR_DETECT(r6, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x30, r7, 0x4, 0x70bd27, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x50}}}}, [@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xfffffff0}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x7}]}, 0x30}, 0x1, 0x0, 0x0, 0xc011}, 0x40000) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000540)=0x228, 0x4) r8 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000580)={'syz_tun\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r8, 0x89f2, &(0x7f0000000680)={'ip_vti0\x00', &(0x7f00000005c0)={'ip_vti0\x00', r9, 0x8000, 0x8000, 0x8, 0x0, {{0x21, 0x4, 0x3, 0x0, 0x84, 0x64, 0x0, 0x1, 0x29, 0x0, @rand_addr=0x64010101, @loopback, {[@timestamp_addr={0x44, 0x4c, 0xb, 0x1, 0xb, [{@local, 0x7}, {@local, 0x8000}, {@empty, 0x5}, {@rand_addr=0x64010102, 0x2}, {@remote, 0x7fff}, {@local, 0x5}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4}, {@rand_addr=0x64010101, 0x7}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x7}]}, @cipso={0x86, 0x11, 0x3, [{0x1, 0x3, "02"}, {0x5, 0x8, "1956cfd44d26"}]}, @noop, @lsrr={0x83, 0xf, 0x37, [@loopback, @local, @multicast1]}]}}}}}) r10 = open(&(0x7f00000006c0)='./file0\x00', 0x800, 0x1c2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xe1c7ff16aa82473d, &(0x7f0000000740)={0x3, &(0x7f0000000700)=[{0x8, 0x3, 0xc, 0x100}, {0x5, 0x4, 0x9, 0x8}, {0x5, 0x6f, 0x5, 0x5}]}) ioctl$VT_OPENQRY(r10, 0x5600, &(0x7f0000000780)) syz_genetlink_get_family_id$l2tp(&(0x7f00000007c0), r5) ioctl$XFS_IOC_AG_GEOMETRY(r10, 0xc080583d, &(0x7f0000000800)={0x1, 0x7fff, 0x8, 0x9, 0xfffffff6, 0xfff, 0x3fd8, 0xffff}) ioctl$SIOCX25SFACILITIES(r10, 0x89e3, &(0x7f0000000880)={0x4a, 0x4, 0x5, 0x5, 0x80}) r11 = socket$l2tp(0x2, 0x2, 0x73) ioctl$BLKZEROOUT(r10, 0x127f, &(0x7f00000008c0)={0xfffffffffffffffb, 0x3}) prctl$PR_GET_ENDIAN(0x13, &(0x7f0000000900)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000940)) ioctl$sock_inet_SIOCGIFNETMASK(r11, 0x891b, &(0x7f0000000980)={'sit0\x00', {0x2, 0x0, @empty}}) mkdirat(r10, &(0x7f00000009c0)='./file0\x00', 0x8) sendmsg$TIPC_CMD_SHOW_STATS(r1, &(0x7f0000000ac0)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x1c, r4, 0x800, 0x70bd2c, 0x25dfdbff, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20040004}, 0x40811) prctl$PR_GET_ENDIAN(0x13, &(0x7f0000000b00)) 2m39.8436362s ago: executing program 0 (id=2308): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000380)=@abs, 0x6e) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000007, 0x2172, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000001000/0x4000)=nil) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000003680)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128\x00'}, 0x58) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) keyctl$join(0x1, 0x0) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)={0x48, 0x2, 0x6, 0x3, 0x0, 0x0, {0x5}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}]}, 0x48}}, 0x0) sendmsg$IPSET_CMD_SAVE(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x1c, 0x8, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x10) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000180)=0xfffffffa, 0x0, 0x4) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_SYMLINKAT={0x26, 0x24, 0x0, r6, &(0x7f0000000000)='./file0\x00', &(0x7f00000001c0)='./file0\x00'}) io_uring_enter(0xffffffffffffffff, 0x66ae, 0x4, 0x2, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000001440)=""/4106, 0x100a}], 0x1, 0x300, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) 2m38.897438852s ago: executing program 0 (id=2310): r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'lo\x00', 0x0}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000080)={'syz1\x00', {}, 0x0, [0x80000000, 0x3, 0x3fc, 0x8, 0xfffffffd, 0x0, 0x4000004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x4, 0x0, 0x0, 0x40, 0x0, 0xf5b1, 0xffffffff, 0x10000000, 0x9, 0x20000000, 0xfb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffe, 0x0, 0x0, 0x1], [0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xedc0, 0x0, 0x5ee, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa0000000, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0xfffffff8, 0x0, 0x0, 0x2000079, 0x400, 0x0, 0x0, 0x10000, 0x40000, 0x1, 0xc0800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x4771, 0x0, 0x0, 0x3], [0x0, 0x7f, 0x8001, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x6, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0xfffffffc, 0x4], [0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xfffffffe, 0x8, 0x0, 0x0, 0x0, 0x3, 0xfffffffc, 0x8, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x3, 0x2, 0x0, 0x0, 0x10, 0x5, 0xfffffffd, 0x0, 0x0, 0x0, 0x8001, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8ec5, 0x0, 0x8000000, 0x4, 0x0, 0x0, 0x0, 0xffffe]}, 0x45c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x2, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f00000004c0)=0x1, 0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000011c0)=@newtaction={0xe78, 0x30, 0x25, 0x0, 0x0, {}, [{0xe64, 0x1, [@m_pedit={0xe60, 0x1, 0x0, 0x0, {{0xa}, {0xe34, 0x2, 0x0, 0x1, [@TCA_PEDIT_KEYS_EX={0x10, 0x5, 0x0, 0x1, [{0xc, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x700}]}]}, @TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{}, 0x2}, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0xfffffffc}, {}, {}, {}, {}, {0xe}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x8000}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xb}], [{}, {0x5, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe78}}, 0x0) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f0000000100)=@gcm_128={{0x303}, "7c80690ea8c8123e", "f92dafad9e3b473a1eaac151fe41ea97", "ee367a98", "74aff2072572aca8"}, 0x28) writev(r2, &(0x7f0000001780)=[{&(0x7f00000006c0)="ba74d6a717d19f0797fd", 0xa}], 0x1) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "000037d7009400", "c0b6c5b29ca2b838d41ac2fc7ddf972d", "e9be1eae", "bb10000000000001"}, 0x28) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newqdisc={0x24, 0x24, 0xd0f, 0x200000, 0x0, {0x60, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0x7, 0xfff3}}}, 0x24}, 0x1, 0x0, 0x0, 0x40800}, 0x0) 2m38.793948041s ago: executing program 0 (id=2311): r0 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async, rerun: 32) socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) sched_setscheduler(0x0, 0x1, &(0x7f00000002c0)=0x2) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000000), 0x4) (async) r2 = shmget$private(0x0, 0x13000, 0x1, &(0x7f0000feb000/0x13000)=nil) shmat(r2, &(0x7f0000ff7000/0x3000)=nil, 0x400c) (async) munmap(&(0x7f0000fee000/0x2000)=nil, 0x2000) (async) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f00000001c0), 0x0) (async, rerun: 32) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000200), &(0x7f0000000100)=0x8) (rerun: 32) socket$qrtr(0x2a, 0x2, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1e, 0x42, &(0x7f0000000240)=ANY=[@ANYRESHEX=r0], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async, rerun: 32) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), 0xffffffffffffffff) (async, rerun: 32) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f0000000080), 0x802, 0x0) read$msr(r3, &(0x7f0000000300)=""/102392, 0x18ff8) (async) open_tree(0xffffffffffffffff, 0x0, 0x0) r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) r5 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r5, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) (async) ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f0000000f40)={0x8, "b546baa5cc590d3033de259c2996817bb959ebab028deda525e19bdeffafde25", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r6, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e681cdb9e581a38ebb0ddd5f307e56", r7}) close_range(r4, r5, 0x0) ioctl$SYNC_IOC_FILE_INFO(r6, 0xc0383e04, &(0x7f0000000040)={""/32, 0x0, 0x0, 0xe, 0x0, 0x0}) 2m37.902959032s ago: executing program 0 (id=2313): r0 = syz_open_dev$ndb(&(0x7f00000001c0), 0x0, 0x400) ioctl$NBD_CLEAR_QUE(r0, 0xab05) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, 0x0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, 0x0) ioctl$KVM_GET_REG_LIST(0xffffffffffffffff, 0xc008aeb0, 0x0) r1 = openat$dlm_control(0xffffff9c, &(0x7f0000000040), 0xa0701, 0x0) pwritev2(r1, &(0x7f0000000140)=[{&(0x7f00000001c0)='W', 0x1}], 0x2, 0x0, 0x0, 0x0) write$selinux_access(r1, 0x0, 0xfffffffffffffed9) 2m22.769886016s ago: executing program 34 (id=2313): r0 = syz_open_dev$ndb(&(0x7f00000001c0), 0x0, 0x400) ioctl$NBD_CLEAR_QUE(r0, 0xab05) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, 0x0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, 0x0) ioctl$KVM_GET_REG_LIST(0xffffffffffffffff, 0xc008aeb0, 0x0) r1 = openat$dlm_control(0xffffff9c, &(0x7f0000000040), 0xa0701, 0x0) pwritev2(r1, &(0x7f0000000140)=[{&(0x7f00000001c0)='W', 0x1}], 0x2, 0x0, 0x0, 0x0) write$selinux_access(r1, 0x0, 0xfffffffffffffed9) 25.21949616s ago: executing program 4 (id=2754): prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x244}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) unshare(0x62040200) socket$l2tp6(0xa, 0x2, 0x73) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x13, 0xffffffffffffffff, 0x3000) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x1c1) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$XFS_IOC_FSGROWFSDATA(r3, 0x4010586e, &(0x7f0000000040)={0x8, 0x1000}) getsockopt$inet_tcp_buf(r3, 0x6, 0x1a, 0x0, &(0x7f00000000c0)) mount(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x14010, 0x0) connect$vsock_stream(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x2710, @local}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000001040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000001080)=0x14) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000200)=@filter={'filter\x00', 0xe, 0x4, 0x390, 0xffffffff, 0xf0, 0x240, 0xf0, 0xffffffff, 0xffffffff, 0x328, 0x328, 0x328, 0xffffffff, 0x4, &(0x7f0000000000), {[{{@ip={@broadcast, @loopback, 0xff, 0xffffffff, 'vlan1\x00', 'macvlan0\x00', {}, {}, 0x62, 0x2, 0x42}, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'veth0\x00', {0x63, 0x518, 0x7fff, 0x586b, 0x2, 0x200, 0xfffffffc, 0x78, 0x80}, {0x8000000000000001}}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x6}}}, {{@uncond, 0x0, 0xf0, 0x150, 0x0, {}, [@common=@osf={{0x50}, {'syz0\x00', 0x0, 0x4, 0x2, 0x2}}, @common=@ah={{0x30}, {[0x10001, 0x6]}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x1, [0x0, 0x7, 0x2, 0x2, 0x1, 0x3]}, {0x2, [0x4, 0x1, 0x7, 0x1, 0x0, 0x3], 0x2}}}}, {{@ip={@remote, @empty, 0xff000000, 0x0, 'vlan1\x00', 'vcan0\x00', {}, {}, 0x29, 0x2, 0x8}, 0x0, 0x70, 0xb8}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@multicast1, 'pim6reg1\x00', {0x8}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = add_key$keyring(&(0x7f0000000340), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) add_key(&(0x7f0000000240)='dns_resolver\x00', &(0x7f0000000080)={'syz', 0x1}, &(0x7f0000000280)="dee7030022cf5c6c7bc31bd2599759fafa9e5e1dbac27b0426fc0299c41fb9b9761a1b44dac894f365ae68edf335abf35ec53d6751467ebd2c187491bcab2c8d34fec505fc8a14622dba33ff9b054eb7e8a5bc4ab2719cb230328931deb95ef3fcafb1ce27743a93f4715976edec860ab49c3a4f51ab0124b50c3362201a307df03000", 0x83, r4) keyctl$search(0xa, r4, &(0x7f00000000c0)='dns_resolver\x00', &(0x7f0000000140)={'syz', 0x1, 0x2e}, 0x0) 22.717932549s ago: executing program 4 (id=2758): r0 = socket(0x3, 0x2, 0x9) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000000), 0x40040, 0x0) (async) r1 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000000), 0x40040, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000040)={0x6, 0x3, 0x3, 0x0, 0x8}) sendmsg$NFT_MSG_GETOBJ_RESET(r0, &(0x7f00000001c0)={&(0x7f0000000080), 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xb0, 0x15, 0xa, 0x101, 0x0, 0x0, {0x3, 0x0, 0x3}, [@NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_OBJ_USERDATA={0x79, 0x8, "f8a66a779a02382acfaae89612c794463b89e91536beacffb6dccf921a2fa32d7417efb0af214f183f634145d6b5e388edb5da4047e214e2d625c73530ff04709fd058f5deab694751af101d93b4556d4d7d8b2007f59c234870ed2f1c3402f52c1481ab109b103802922fde42d1195770352e8a90"}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}]}, 0xb0}, 0x1, 0x0, 0x0, 0x810}, 0x4000000) syz_genetlink_get_family_id$tipc(&(0x7f0000000240), r1) (async) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000240), r1) sendmsg$TIPC_CMD_SET_NODE_ADDR(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r2, 0x200, 0x70bd27, 0x25dfdbfd, {{}, {}, {0x8, 0x11, 0xfffffffa}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x54}, 0x44) (async) sendmsg$TIPC_CMD_SET_NODE_ADDR(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r2, 0x200, 0x70bd27, 0x25dfdbfd, {{}, {}, {0x8, 0x11, 0xfffffffa}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x54}, 0x44) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0xf, &(0x7f0000000340)=0x401, 0x4) sendmsg$DEVLINK_CMD_TRAP_SET(r1, &(0x7f0000000640)={&(0x7f0000000380), 0xc, &(0x7f0000000600)={&(0x7f00000003c0)={0x224, 0x0, 0x8, 0x70bd28, 0x25dfdbfc, {}, [{@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5, 0x83, 0x1}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5, 0x83, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5, 0x83, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5}}]}, 0x224}, 0x1, 0x0, 0x0, 0x40000080}, 0x810) (async) sendmsg$DEVLINK_CMD_TRAP_SET(r1, &(0x7f0000000640)={&(0x7f0000000380), 0xc, &(0x7f0000000600)={&(0x7f00000003c0)={0x224, 0x0, 0x8, 0x70bd28, 0x25dfdbfc, {}, [{@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5, 0x83, 0x1}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5, 0x83, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5, 0x83, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5}}]}, 0x224}, 0x1, 0x0, 0x0, 0x40000080}, 0x810) r3 = syz_usb_connect$hid(0x4, 0x3f, &(0x7f0000000680)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x20, 0x56a, 0xc7, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x10, 0x5, [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x1, 0x3, 0x8e, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x77c}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x4, 0xa8, 0x1}}, [{{0x9, 0x5, 0x2, 0x3, 0x10, 0x96, 0x4, 0xc}}]}}}]}}]}}, &(0x7f0000000880)={0xa, &(0x7f00000006c0)={0xa, 0x6, 0x310, 0x12, 0x11, 0x8, 0x40, 0xda}, 0x29, &(0x7f0000000700)={0x5, 0xf, 0x29, 0x1, [@ssp_cap={0x24, 0x10, 0xa, 0x45, 0x6, 0xb8f, 0xf0f, 0xb5, [0xc030, 0xc000, 0xc000, 0xcf, 0xff0000, 0xf]}]}, 0x2, [{0x4, &(0x7f0000000740)=@lang_id={0x4, 0x3, 0x459}}, {0xc9, &(0x7f0000000780)=@string={0xc9, 0x3, "dbab1f7de8b80e925970084984881e6ac8508d82e475892791924c0d1f77e3c36e5cbe3527c3e54aa4422943f435e6635debd509d14c750df432ccc7cf4404841f91e9c452b62b7802caca68a8e13e65fa23ac6c7bcc028363db673493bc73fc6bd59ee5217fc8121ed6509915454047f438a47b1bf24b80b97e34da0d46bb25aa4c533364b536c6ee1694720e6892bd897ec98df90541feb87e65820c900d99fc307041be64a288b4dfe36288d214fbc1086a2e3a544d4bbd612d640265561c642ab6e64ed9da"}}]}) syz_usb_control_io$hid(r3, &(0x7f0000000a40)={0x24, &(0x7f00000008c0)={0x40, 0xc, 0xa0, {0xa0, 0x5, "c00a8803bcb8c9a743616a9601503e860b64577588dd6d0d9cb3fb96abdfca05a141cd8c80ad3977bdc1b7ccc5100427a212c42290431e24d755f5dbfdd39535eb3b82eef2e90d61cc8b645dccff2dc946a47d394a24615c68132c19a64d1651e3a49e283c7a611c035760af3798b3a02e7c344deaa11640284ea8949b77867faa0a3ed4d508c63170ce23fb440d296dde39b2fd3fb249a6e644baf79e6a"}}, &(0x7f0000000980)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x813}}, &(0x7f00000009c0)={0x0, 0x22, 0x9, {[@local=@item_012={0x2, 0x2, 0x0, "97b9"}, @global=@item_4={0x3, 0x1, 0x3, "2ea902fa"}, @main=@item_012={0x0, 0x0, 0xa}]}}, &(0x7f0000000a00)={0x0, 0x21, 0x9, {0x9, 0x21, 0x52b, 0x3a, 0x1, {0x22, 0x497}}}}, &(0x7f0000000d00)={0x2c, &(0x7f0000000a80)={0x0, 0xf, 0xdd, "132744e5501fb1503c85f74c812d7e48ffd3bf9d7ea05c71ef75558c3e948dc8542cde49922826461030f4459ea767be6b8c1f2f59179dd2e783968552a5af625f5d8272b6a8452121e212a5b8cfe1e3c99c4c78cf0de6042dd5e64a144ca4bddaa1490eba035d4f1e65f76e65ba1728dc37e44339ab18e2a1d39dd22f6bea410cb5b07c0a8843ea9270aa8ce23346c09fe0352f34a37806e710f9091ffef936e00205a4c00b08c9750724638baba7faf5b58e911a48e4c2fd205afee77169cc8e5f3ac7ae7e72443950e16d780b5bffdb114b521ce7dbbeada8bb7415"}, &(0x7f0000000b80)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000bc0)={0x0, 0x8, 0x1}, &(0x7f0000000c00)={0x20, 0x1, 0x7c, "a4210a0402b967a162b6eb3346796ba11c83c206d3709ea221829b9a0d0e6c498b57ce39c6b0cca579c05d666c75e7d14b7fe6e2b50eeee953108c09ee2e78f31e19389acec60cab44cb9fb833e00c6165875c0c09471f6c0391e2eab2cda88b01b38cfafcad1cbfafd7b90e9c3d860cc98c06a8bc5f4160bddb76ff"}, &(0x7f0000000cc0)={0x20, 0x3, 0x1, 0x5}}) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r1, 0xc0096616, &(0x7f0000000d40)={0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000d80)='/sys/power/disk', 0x129440, 0xe0) lsm_set_self_attr(0x64, &(0x7f0000000dc0)={0x6d, 0x8, 0x73, 0x53, "172ef754ee11ded69ad9ac478ab867f032c457360c57c2b5bb5a61ed62fc4745bc5a508596e534ac51189123106d76cb428a7b62bcae12a9fef24b63100c984ad1b43e5ceb918ba9fa4c0e16b2ee1e46d1d692"}, 0x73, 0x0) (async) lsm_set_self_attr(0x64, &(0x7f0000000dc0)={0x6d, 0x8, 0x73, 0x53, "172ef754ee11ded69ad9ac478ab867f032c457360c57c2b5bb5a61ed62fc4745bc5a508596e534ac51189123106d76cb428a7b62bcae12a9fef24b63100c984ad1b43e5ceb918ba9fa4c0e16b2ee1e46d1d692"}, 0x73, 0x0) r5 = epoll_create(0x7) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000e40)='/sys/power/image_size', 0x40002, 0x8) sendmsg$802154_raw(r0, &(0x7f0000000f40)={&(0x7f0000000e80)={0x24, @none={0x0, 0x1}}, 0x14, &(0x7f0000000f00)={&(0x7f0000000ec0)="5e11e94de5ea704bd5262d8256196e9e94", 0x11}, 0x1, 0x0, 0x0, 0x44042}, 0x4008000) setsockopt$RDS_FREE_MR(r4, 0x114, 0x3, &(0x7f0000000f80)={{0x3, 0xd}, 0x4c}, 0x10) r7 = syz_genetlink_get_family_id$team(&(0x7f0000001000), r6) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r4, 0x89f8, &(0x7f0000001100)={'tunl0\x00', &(0x7f0000001040)={'gre0\x00', 0x0, 0x8, 0x700, 0xffff8001, 0x5, {{0x1d, 0x4, 0x2, 0x0, 0x74, 0x64, 0x0, 0x9, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0x14}, @private=0xa010102, {[@ssrr={0x89, 0xf, 0x14, [@multicast1, @rand_addr=0x64010102, @remote]}, @timestamp_prespec={0x44, 0x2c, 0x7f, 0x3, 0x8, [{@broadcast, 0x7}, {@remote, 0x3}, {@empty}, {@dev={0xac, 0x14, 0x14, 0x1f}, 0x6}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}]}, @rr={0x7, 0xf, 0x6c, [@dev={0xac, 0x14, 0x14, 0x19}, @initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @rr={0x7, 0xb, 0x6e, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010101]}, @lsrr={0x83, 0xb, 0x9d, [@initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x31}]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r6, 0x89f2, &(0x7f00000011c0)={'ip6tnl0\x00', &(0x7f0000001140)={'syztnl2\x00', 0x0, 0x29, 0x3, 0x1, 0x7fff, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private0, 0x40, 0x8, 0x2, 0x9}}) sendmsg$TEAM_CMD_PORT_LIST_GET(r4, &(0x7f00000012c0)={&(0x7f0000000fc0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000001280)={&(0x7f0000001200)={0x60, r7, 0x400, 0x70bd25, 0x25dfdbfd, {}, [{{0x8, 0x1, r8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xffff}}, {0x8, 0x6, r9}}}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000001}, 0x800) (async) sendmsg$TEAM_CMD_PORT_LIST_GET(r4, &(0x7f00000012c0)={&(0x7f0000000fc0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000001280)={&(0x7f0000001200)={0x60, r7, 0x400, 0x70bd25, 0x25dfdbfd, {}, [{{0x8, 0x1, r8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xffff}}, {0x8, 0x6, r9}}}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000001}, 0x800) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000001300)={'pim6reg0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000001300)={'pim6reg0\x00', 0x0}) setsockopt$packet_add_memb(r4, 0x107, 0x1, &(0x7f0000001340)={r10, 0x1, 0x6, @random="2a5c700cf2d8"}, 0x10) sendmsg$SOCK_DESTROY(r6, &(0x7f0000002600)={&(0x7f0000001380)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000025c0)={&(0x7f00000013c0)={0x11d4, 0x15, 0x100, 0x70bd26, 0x25dfdbfd, {0x29, 0x4}, [@INET_DIAG_REQ_BYTECODE={0x6e, 0x1, "8058a2d2ea1f6f80c657d9dbb2fc3c957abead80c6c631fb9daf0be3b31500d579993ad4015cc6ad6d39fd6d86dc9922bd37904cb8b1ce9d12d98a0f7c8542438e4a502b033101dfdaf4f11e37d0194c8695fcf4cf8434284bb78acec9339762cbd967668f6d1cfdac99"}, @INET_DIAG_REQ_BYTECODE={0x6b, 0x1, "e8558a6fc56ec3742b35fb328d607d8075adecd02b6ba1444b67d58f3bbc8986db81a315522de20954ce3f13b2ce41c8003123a8c5cd1f9682ae5d34904bed84c08257e8730eb17b83304ac48362a924579f700af34d72cdedcbe6db541c4a6f4df4d80236f277"}, @INET_DIAG_REQ_BYTECODE={0x1004, 0x1, "c60559a02d1e6d3363a5b50b15a73235dbc90748ea6bcc60d3370ee84f678fab605572fc1fd09b233efe2c3a2d667429bdddf6b91c71f0212df14ecd20b1de943adc07e4061ac9a8cdfc54418c9ef179d8b77b023e8ca1ff2bd40037fc2c692555e9dafdcab985ba927b395f7f0f7f8fae79c3940323118a9aab73cd465b17359fc881e098bd2e643b1f289412b29f70f4aa440ae64fee1535e9fd9d70be4e300b5578ca7700174c6070cd7631675e3efe61d1c551088eb22b6738fe82b0a15f0d6a911f25f0399bd85157b2617a5c62f3ddb2b3ff3982e7b5987e65b72440cf4931927f01c98251bdeec3afe7d3b7b84c01a42aa40b41d25ada9166a1238f551890673fae18758952b6a8126d205dc5ef7049a0c8e0a851c4f6ec9efc17bd859f2724199fcb2ee72aa08ffc301d4821cd0a7e11cb10822aaf4e27a7c43562b9f6a00020461576d0fb19bf782a91bdd16c098da7c66b9fe2cd48fd461ca0731cc81b45b9990940d3385d7996a1fcadd983fe7ab4b97590595e8e03b49b74340a0f19fa1c36d60e30f91a72caa7210d137235423f8d1883f49637bdd7a0f565b570ca24de45bb504adce256369bde452ac92d12af5ac3b9c81afd83a60140e4e48042ef1c167d0bc0b40a422cefa0e8717859f0271c1ac0becf009d0f3c2f438ffa56a98c1b66c8f003b344189a02901758b119e70a718ef015311af8aa19611836cd7652177536ac739f26f93c315e4cdf9e6ce8e3c46aa36b5b0b775181d32c06b8707ac471a576715b799bfb30a8097224e8a771873f3c99a624c046f5a1abcbf1611d82d503cf9c7d3cf38ea08a7f0365edf4f9484b6847046f92f75e8d83d6c6a9bac6339f0287835413ee4ed64ee5cf642f24666a140b4745c8fe30a80d2ef6fb99855599cf578ac8301b0f9df1e706d2168d27f73b2247e8927c85b648f07919495a56c050f1ea784975926e3e6debcd636be6ba7b1edc19526204039a14a32bdd68e07e4b44535c02b580cf935d44d6f3402707a56b27d8888807d6873afa3a88e44a7ffbddf795afc1dba0383a3e608fdb097bfdd90051b5d7e9329c6cd17b91e822bdee61e2a84b5f095760790792c85aa5286213ab9da8a9dd916cb671be92d81c5f43f5c20d6cf1aee4c70ab86c70b346585b0ef0c030bf3c00f13b04a3ea70f3d8fc2b5c550c93feaeedad701c0629c3a85eaa2ee3dd161df6a2106aa59b0d6fd19e1fef16ddb355237df31f67729b6f8564f97321502aabd4767509e903fb534e95b49a4376e647527517ac08c7a9077f491d7f328d667ec99392e826192c04f7f354e1c01224395623527d21e0b5fa398e99ef3194eae9ae3659b2a4666cabbaf3d89873ba4f0fdd87988e58e452f939dcd94707f777e98adfac57600dc94e5801c0ddf27fa9951b48bc7c39c7a0683f15329acf36a5269110025e1da64a2b5458e03037ec941c13fcc97e81d655a1ebd8ece489a98c43edd8a26924a9466665dc6d56d88d49924f0ac5a798dbac98da2e4492d1499c353dde1db34488d67c375c0f53085b33505359a355ecad5bffe4ee2e45550025f417e4ba24c3337b60701bfdd0281f0f7569d6417c52885f78123df92a67685e87822a36649a2ce441e5f6bf730e1d80d2b5479a5eb05a8a3a90e73bd95a8a6c87f31d6779ca8b9dadd71cc65972c02ef0fdccf97fdd2062776d3ef7c474b771b1bc2deafb38e71354fdc011ed021fe3c0379406bee1c9cdd7c0c53a1e6172ebf71d0c7d9427dd3aecc89166a277220714db71e57f6eee34c18a7b49a9706e0560de0bc1d6c6941e61b93000abe445c91365fefbcfc2898d05a77335fa839af198b628a0f55beab6d3ed2f2b48e73f295cd74b1c795d64d14e0cd00445de60941f198904ff2f7d252b94b726da4293253c6d771d7e431f91527a105d6109df4465ecc02a1ee6d5cf19ee46d0d691b4097d5491ec4ded1dd9a3c284c79b78d2fda1e11f47000e2ba4bfbb070007965917424f8ce3a2d44e723d9df4e77fa4ce5a81c4f14b3d48214e6337bb4491e5ee891a75a08e8380f34e450b814baa3789de24930d379e1bea9033168c2e0ea2280d952fb04d516ed35699b8f634333d2dcbb736ad9defc1dc1c1b6c75607e9547b93d6c34b9865bd1e5ba35e6119930dea0d0a86d590c989af22cb4df5c09bb94a85c833089e2b67b8e58ef521f3140ce2e7749bfb0a0362e3447f87f0ba9b5d2aace1f4fb6f8daaee3efafc67633405e28b33b83a37d8726b22950ccaef7c487f6b067d6063ec7d0e66440c752f611e7b9b74d70d63a248d4be6ab5a41944d9dfc5861b63fabf43b77baf1da2a59801ef8f755f7fa10f634843f802fdaa028c1644caba7c7e0dbbac47fed009ad151338e54206c3f272aabcbaa99ad48efdbd71fadda674638eba421335165019a910be2a0ff2fc551b7fb54bf61085173ca47fe47fbd48a89267b62a3710fb6957701b08fbf6515e77d53153c90776a4350be0081fed10b4e494c17ac03a84eba0801cfac5ad4ad8411f87ebdd6fb40835a5ece9e9ca1ed362dfa12606aaca4d1c12d4665896d2bc1cacad08b1800402251238f660b4f7d91690306f50d339e6c1ba0c9c7db9de4ded6149bac811668ee56477304252103116bbbe83ca499751e65cae8d4bb28adccd2e6329f954072373cdafa1fb5483f99c3b193f259e055c42e3e35b28001ac9b95ab0e64ea1d221298a97acf4372705874c78290108474b801bce07dd5afa7f65e00e5583714dadc647770fccc3eea8247bcfd45bbf60e51cf1f3d0b6e04862c0ebbbe1079223c924e9b883731eb7db26f919f164329a4c945c7e8df6742d498b5cb3a1eaa71174def8e44ff1ba208ea36f090b23077f70e11aa3fc4724a0e547098b04e68483934a9911c444de9582d78603d893e22a6770d388361acd43f0821bd2e28ec99bb46facfc27515d6bf9a95216488824d337d4f1ddbc613a93f3e6e861e726a6db133b3d5dd36fb95233fb0bcced09392af99ccf6181b727e2e9bac5ee89c1c01a331b30d266b04440b6347613e21f2b572b3066a5244de65e976c8f8f88c72648a0a96d80d550237fa8649799bbe2b61506371c15db653e6eff77e27f1d25dbe7b3940f76c4754dbee6ec744652620890becc31e2ebd6ca3780f1093a2a8a0fc8b5ceecb789ec2adb07b688676afeaa47cbcb04793de2f2cfc74e6f3d020461ec9cc8ba91393862e23af53794a281e454269807de3656b5bca3295019a295f7867d3e63158192cb883faf891cb01b469e2cb3f8c311b73123a0f29cc1f9e92909670bf0b807e36365d658383609f38a32f3247aa5e81db2bbe3cedaa5df400ed90843c4f9eda971ff8888b8532221ab828ba358281380aa91935382e79a5ccd3160af79b95b5bc5fb55b96bfbe5348c0d3645ef972afd83006d52e18ed572232d7c3d695d15e945bf75279ceed06bf10d0a5aa60a0e9f2e616d19be4261cd4944fa6aae4c682d756f85bb36664956cd3dde10428cc287001a7c055f9e3fb6693c147c6be3de405ac3c3cc0a485fb89f5c0b99a247ef9a06e48462677eb60cd0db615652b17d6519f84703b6984e0a5bbd6cb886c27e9432d2581b038d2813cf921a7e0f07aafa356de11ef9346551f6eca36f3233dc71eb2e592b5b6a14424f0fc3167c7c36307f0c5a9a1c9e263c7365adb37a7ebe7c10acf1331bea20b1050f01ec18ca97a24e415f52d7e5d8e6cf8fba22f7b141125a67368213bd49b6a54ecd14b51c6cf2162d7919575b8b7c8724b23427bfd4189fb68d618c5e8aaec0406cd33206f888697cb9bf692a06fa456b027e1b25ce507d39a66d9984057737144847a87979b7e1626c68d6ab5b9af842d1c9dc2ff380105f2a5b99b0380970f0490ef2a93d06d7b65ef22941bd6b0d946c7b218021c4aef230435b930f76013ff5792a87981319bf592bfc13517c11d7027d7c3e16bbd419703982d3ce19e21f516c3f5b37cc4319cedc5155ff20b48e5e5c60fade6531c66efa5913ce652aacab9026bc2ff74ce2d4d182b668ce8a0acad78fba6f38f0364ac9d71ea28819103e5854b3b7216e4b9228c7be6c15053b9719ca4f115d6ee17aaf6c8a7bd07d3cbe2d3889540caa9a06cfaec3d88044c202b5d7d6d3ae15b72015db5144b485ee20a2fc2fa3378e661ec5a7965214d1c364e7792a24ab345d4b9465386a15d34daed777f8df304005c25eb0cbb5b109b2b7907fcbfa145974b5ef50610818cc58e25b83277bc97b661896578ee4c406a73638962da6c01735093070feb3d08889c1d5d8376967741419dd223bff00830b9a9b732926c67476c9076e6dd0aab11c31b0c9d46b9c2b69c4b6afcc3a8b47b02f93f8f1e247d6cf2f2e7a910c585cc8faca304f3b393905827932a8dc5db126465dd8064636ebd1553c5048c33999fb612d890d2f7931373a01522528fe3585d8c51ad347fa03b65695b5ffd23ba71fb99611654946bb400063e3d1ec72bd109be05104fb3f3af3b55239c316178017d88f321e0742ba70514cb4018dc82a23a1ab21aaabb3d47f993aafc8476713e3af8da210cc72fc93a0237a3e1f29a59d70a688c91b29a78687d61bfa725b0fd6d76cbcecbe1041d29e1d3aebed8f4d8e9d1a0b57400b8008d7a4f4d23db504738a784f8eb6004cc0e4625a87f9093b9af7ecfba687e6a12a71b36137b33614db534314ece10838e0ef9fa2c9f8d8ed82e61de0cd647bfb55b56e76d7d5ab7b90cf223d3608b9fe25c1586027fc19fcc9441c4a5203da2b6948ee0c422edd9db69f70e570196fe644fd414fa1b4e510ac78dd6bafb8f382b160cce5103f1b0d86e20820529f8b13c292b7fba51086ba057c2a90ffda8b0d2a3a5987a247072f68a0c2ac710c48220fd54818928190225aef68399146f779053a385b5689a6e8588bf65ed8cc0a0f769860e90bdd5c92aafd79ccc36e3b6467330cbde60e8c6663baa92fecc5b5b3ae4626a9e47ab71d129caf43809ad3d771e8697e8f90636d7e218949ae9ece71aece8f3b46e71f78795af3a26439fa5d985549aac4adcc56ea627fd5dae6d7ec6379327f16f8ccf8dc7bd30f1f014a8cfec03000aae2c521dfee79355c86dfe203ec1ced6b9bdc52b1c9555fd3f62fff0766425724087493ce9f2c53b3c987ee45467b1a0b42b1e92842029a0c369dd6af5c6baf205c6601525d32b1c73bd46d576810991f9b86cb3d2aeb0a029a765a42f10d49080d7d5fa4cfac69cc3913809f937d0263fff83d65b688c8f2b7f819874c2580dbdc2b9b83787865590a883eb3169c5d8444cf2cb11da6d996d2cfc0661c4e50cb37847c5c411edf161a297b74cb26de9a68cbad02540bbe2b2bf0b979007fe9bffc0acef591cecd5ac3454438be9c6b0c47ca970f194333f562733e1ad96e4782ae0af327f70d147ee7268dfdbbdf87c9fe5359c790fb38f0f48e5e7439952ce161f893c04928bfbd2f531d1b0c0b1bee3a2043cef9e9d0856816e8c9a8e0ef1b10905fdd2a18d405e442f0d379c0da403d441f9bab9ac2dbaa6aa26ff8a7b2dd31678d4c6b66ff8b146f8ec64eff25a7f949f8e7603df01633273a22b5dee86ebb17179a6f581102cc989c1b9b51353511fa36a3c119fe7d96648cd98d9fbf31319dbecce6abf8e2529e3d16c89bd735c0ecc80460e4182e5c9d39af7ffbbc9c9f42561eb94df96911e692531e07e37151e199e886d20eb9912743b5ce42c915a188244dc4f08cba735e008eb119127b502e55be5dcb5014524c5a8"}, @INET_DIAG_REQ_BYTECODE={0x37, 0x1, "0131305682c000f61f9c68bc26a24df40b5e091b3d072aa4b8dc10a79b5965654b71470b0d80ea6b82ca4aad379a7a87f0b207"}, @INET_DIAG_REQ_BYTECODE={0x70, 0x1, "505748a9abc51979e655843986f43e9b5a748e427d62a9909aad0dc8d1e0041db562d1485781c843e720b8165b9b396ce2b9277beab9a3a44091f7a75f0d5916e4f064faa086d2b19d760a59a86f6253b163fa33a844b1dc8e0efbf3c1732bb90025de2854db9a5b8d5d014d"}, @INET_DIAG_REQ_BYTECODE={0x38, 0x1, "4a7ab01e32ac5f0df80a83f80393d897277cc23abc23f253712ab4402c9e491b0090b58136a8f70f9b34093df6c298360571fe0f"}]}, 0x11d4}, 0x1, 0x0, 0x0, 0x20000000}, 0x20004041) sendmsg$inet(r0, &(0x7f00000027c0)={&(0x7f0000002640)={0x2, 0x4e20, @broadcast}, 0x10, &(0x7f0000002740)=[{&(0x7f0000002680)="fe130c9defefecfcfd80614ec8da1a94bacf6ff70d9ea9c25b058e7e9041e51f3571b203eec040f50212d24949375a26774acef4cd78c9fd52f83a1ef8", 0x3d}, {&(0x7f00000026c0)="8a6b7b89c390ae272048f059066c5d12db100b7e54b64348e3f9725a4ee83db765bcf7d44726a38021b07b0cf5910a42dfa8d21cf279543e2ac6a5a223de438a0fa13c1312b029ddeeed3f72ece5b249aeaf2f9c3c5105a239f09c32832b281c9315460a2f07822a7f4a26b0774ec7", 0x6f}], 0x2, &(0x7f0000002780)=[@ip_ttl={{0x14, 0x0, 0x2, 0x7ff}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x465}}], 0x30}, 0x44000) (async) sendmsg$inet(r0, &(0x7f00000027c0)={&(0x7f0000002640)={0x2, 0x4e20, @broadcast}, 0x10, &(0x7f0000002740)=[{&(0x7f0000002680)="fe130c9defefecfcfd80614ec8da1a94bacf6ff70d9ea9c25b058e7e9041e51f3571b203eec040f50212d24949375a26774acef4cd78c9fd52f83a1ef8", 0x3d}, {&(0x7f00000026c0)="8a6b7b89c390ae272048f059066c5d12db100b7e54b64348e3f9725a4ee83db765bcf7d44726a38021b07b0cf5910a42dfa8d21cf279543e2ac6a5a223de438a0fa13c1312b029ddeeed3f72ece5b249aeaf2f9c3c5105a239f09c32832b281c9315460a2f07822a7f4a26b0774ec7", 0x6f}], 0x2, &(0x7f0000002780)=[@ip_ttl={{0x14, 0x0, 0x2, 0x7ff}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x465}}], 0x30}, 0x44000) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r1, 0xc018937a, &(0x7f0000002800)={{0x1, 0x1, 0x18, r5, {0x2}}, './file0\x00'}) setsockopt$IP6T_SO_SET_REPLACE(r11, 0x29, 0x40, &(0x7f00000028c0)=@mangle={'mangle\x00', 0x1f, 0x6, 0x638, 0xd0, 0x210, 0xd0, 0x328, 0xd0, 0x568, 0x568, 0x568, 0x568, 0x568, 0x6, &(0x7f0000002840), {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@CLASSIFY={0x28}}, {{@uncond, 0x0, 0xf8, 0x140, 0x0, {}, [@common=@ipv6header={{0x28}, {0x40, 0x28}}, @common=@ipv6header={{0x28}, {0x1c, 0x20}}]}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv4=@broadcast, @ipv4=@multicast2, 0x24, 0x2d, 0x5}}}, {{@ipv6={@private2={0xfc, 0x2, '\x00', 0x1}, @empty, [0xff000000, 0xff000000, 0xffffffff, 0xff], [0xff, 0xffffffff, 0xff000000, 0xff000000], 'veth0_macvtap\x00', 'team_slave_0\x00', {}, {0xff}, 0x33, 0x6, 0x4, 0x10}, 0x0, 0xd0, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x6}}]}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv6=@remote, @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x17, 0x0, 0xfff9}}}, {{@ipv6={@local, @ipv4={'\x00', '\xff\xff', @multicast1}, [0xffffff00, 0xffffffff, 0xffffff00, 0xff000000], [0x0, 0xffffffff, 0xff, 0xff], 'veth0_to_batadv\x00', 'veth1_macvtap\x00', {0xff}, {0xff}, 0x51, 0x4, 0x2}, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x5}}, @inet=@rpfilter={{0x28}, {0x9}}]}, @HL={0x28, 'HL\x00', 0x0, {0x1, 0x3}}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@common=@mh={{0x28}, {"b601", 0x1}}, @inet=@rpfilter={{0x28}, {0x1}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x698) (async) setsockopt$IP6T_SO_SET_REPLACE(r11, 0x29, 0x40, &(0x7f00000028c0)=@mangle={'mangle\x00', 0x1f, 0x6, 0x638, 0xd0, 0x210, 0xd0, 0x328, 0xd0, 0x568, 0x568, 0x568, 0x568, 0x568, 0x6, &(0x7f0000002840), {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@CLASSIFY={0x28}}, {{@uncond, 0x0, 0xf8, 0x140, 0x0, {}, [@common=@ipv6header={{0x28}, {0x40, 0x28}}, @common=@ipv6header={{0x28}, {0x1c, 0x20}}]}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv4=@broadcast, @ipv4=@multicast2, 0x24, 0x2d, 0x5}}}, {{@ipv6={@private2={0xfc, 0x2, '\x00', 0x1}, @empty, [0xff000000, 0xff000000, 0xffffffff, 0xff], [0xff, 0xffffffff, 0xff000000, 0xff000000], 'veth0_macvtap\x00', 'team_slave_0\x00', {}, {0xff}, 0x33, 0x6, 0x4, 0x10}, 0x0, 0xd0, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x6}}]}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv6=@remote, @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x17, 0x0, 0xfff9}}}, {{@ipv6={@local, @ipv4={'\x00', '\xff\xff', @multicast1}, [0xffffff00, 0xffffffff, 0xffffff00, 0xff000000], [0x0, 0xffffffff, 0xff, 0xff], 'veth0_to_batadv\x00', 'veth1_macvtap\x00', {0xff}, {0xff}, 0x51, 0x4, 0x2}, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x5}}, @inet=@rpfilter={{0x28}, {0x9}}]}, @HL={0x28, 'HL\x00', 0x0, {0x1, 0x3}}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@common=@mh={{0x28}, {"b601", 0x1}}, @inet=@rpfilter={{0x28}, {0x1}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x698) mkdirat(r6, &(0x7f0000002f80)='./file0\x00', 0x1a8) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000002fc0)={{r4}, 0x9, 0x8000000000000000, 0x5}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r11, 0x89f2, &(0x7f0000003080)={'syztnl0\x00', &(0x7f0000003000)={'tunl0\x00', r10, 0x80, 0x40, 0x8, 0x7, {{0xa, 0x4, 0x3, 0x1c, 0x28, 0x67, 0x0, 0x88, 0x29, 0x0, @multicast1, @private=0xa010100, {[@generic={0x94, 0x11, "3dc938304c3ca28c95fc471e671103"}]}}}}}) (async) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r11, 0x89f2, &(0x7f0000003080)={'syztnl0\x00', &(0x7f0000003000)={'tunl0\x00', r10, 0x80, 0x40, 0x8, 0x7, {{0xa, 0x4, 0x3, 0x1c, 0x28, 0x67, 0x0, 0x88, 0x29, 0x0, @multicast1, @private=0xa010100, {[@generic={0x94, 0x11, "3dc938304c3ca28c95fc471e671103"}]}}}}}) 22.023283334s ago: executing program 4 (id=2761): r0 = openat$selinux_policy(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x20, r2, 0x2, 0x2000, 0x2, {}, [@NL80211_ATTR_TXQ_LIMIT={0x8, 0x10a, 0x4}, @NL80211_ATTR_WIPHY_DYN_ACK={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0xc8c4}, 0x0) sendmsg$NL80211_CMD_SET_COALESCE(r1, &(0x7f0000000200)={0x0, 0xffffffffffffff8c, &(0x7f0000000b00)={&(0x7f0000000040)={0x28, r2, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r4}, @void}}}, 0x28}, 0x1, 0x6c00}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x8010, r0, 0x0) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000440)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@volatile, @volatile]}}, 0x0, 0x32}, 0x28) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYRESHEX=r5], 0x0, 0x26, 0x0, 0x1, 0x10000}, 0x28) r6 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x103000) ioctl$CEC_TRANSMIT(r6, 0xc0386105, &(0x7f0000000040)={0xfff, 0xffff, 0x3, 0x5ba, 0x0, 0x6, "72a3b8ad27041527c8b46da6662fe029", 0xfe, 0x0, 0x9, 0x0, 0x0, 0x7, 0x6}) capset(&(0x7f0000000040)={0x20080522}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r7, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)={0x2c, r8, 0x601, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x18, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x2400c005}, 0x40) sendmsg$TIPC_NL_BEARER_GET(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000240)={0x144, r8, 0x300, 0x70bd2a, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0x48, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2933}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}]}]}, @TIPC_NLA_SOCK={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xcd8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_MEDIA={0x54, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_SOCK={0x78, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x4c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x40}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1}, @TIPC_NLA_CON_FLAG={0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}]}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1d}]}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffff175}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x10}]}]}, 0x144}, 0x1, 0x0, 0x0, 0x1}, 0x40000) 21.871276848s ago: executing program 4 (id=2762): openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) r1 = add_key$fscrypt_v1(&(0x7f0000000300), 0x0, 0x0, 0x0, 0xfffffffffffffffd) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) sched_setaffinity(0x0, 0xfffffffffffffdb1, &(0x7f0000000280)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000001a40)=""/102392, 0x18ff8) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0x7, &(0x7f0000000000), 0x0) shutdown(r3, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x7a, &(0x7f0000000340)={0x0, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) keyctl$instantiate(0xc, 0x0, 0x0, 0x2a, 0x0) r4 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) mkdir(&(0x7f0000000380)='./file1\x00', 0xa) mount(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)) fchown(0xffffffffffffffff, 0x0, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) keyctl$read(0xb, r4, 0x0, 0x0) keyctl$get_persistent(0x16, 0x0, r1) sendmsg$inet(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000180)="5c00000013006bcd9e3fe3dc4e48aa31086b8712380000001f00000000000000040014000d000a00140000009ee517d34460bc08eab556a705251e6182949a3651f60a84c9f5d1938837e786a6d0bdd7fcf50e4509c5bb", 0x57}], 0x1, 0x0, 0x0, 0x1f000801}, 0x200000000000000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f00000000c0)={'team0\x00', &(0x7f0000000380)=@ethtool_drvinfo={0x3, "2be9192e134934371f20fc664918e3e09c78f7ab3012e2397d43a41dd59111f2", "4d208a0bf892aceff916fc5c2655406702f03088c42eb5b2adb7719df8cf4d1e", "aacae6fe743cd3b8a6f6e21161ca85731e264f6655fec2dfff30f06c2458c26c", "f8a5a6d6884854e17058000d6deafe1190eef34064d94a036c653ff3ec76f16d", "3d358b4fbb139e74d533b3ee1c5d0a8394e27d9eee171fe899dbd36a499335d1", "238d42bf6be2711c19d25cfc", 0x0, 0x0, 0x5, 0x9, 0x8}}) r6 = syz_io_uring_setup(0x4b5, &(0x7f0000010400)={0x0, 0xaab0, 0x1, 0x8, 0xad}, &(0x7f0000010080), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_BUFFERS(r6, 0x0, &(0x7f0000000140)=[{0x0}, {0x0}], 0x2) socket$kcm(0xa, 0x3, 0x3a) 21.376244472s ago: executing program 4 (id=2764): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = getpgid(0x0) rt_sigqueueinfo(r1, 0x29, &(0x7f0000000080)={0x13, 0x200, 0x6}) socket$pppoe(0x18, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[], 0x18}}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.current\x00', 0x275a, 0x0) write$cgroup_pid(r2, &(0x7f0000000000), 0x2a979d) ioctl$SIOCSIFHWADDR(r2, 0x401c5820, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0100000000000000000017000000540006803c00040067636d286165732900000000000000000000000000000000000000000000000014000000e3de3d7b4cd07ec3ee777de774fc7987cca41989140003"], 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x4008014) 20.143566069s ago: executing program 4 (id=2768): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x1d, &(0x7f0000000180)=0x7, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000340)=0x63ba, 0x4) sendmmsg$inet6(r0, &(0x7f0000000880)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x8, @ipv4={'\x00', '\xff\xff', @loopback}, 0x9}, 0x1c, 0x0}}], 0x1, 0x60040000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_usbip_server_init(0x1) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000040)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) open$dir(&(0x7f0000000280)='./file0\x00', 0x80000, 0x10) mkdirat(r2, &(0x7f0000000240)='./file0\x00', 0xf8) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r4, @ANYBLOB=',wfdno=', @ANYRESHEX=r3, @ANYBLOB="390664ecfbc16718855a55bcff793abf70123030302c00bec05eba43852e5b5f43e7a34ed4ea7782b61aef4df3e80def5b26a017b37f0fb4590ff459a988b18e9eeaae96f87586cee4ea23d04c77b40b"]) write$P9_RVERSION(r5, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r4, @ANYRESHEX=r5], 0x15) recvmmsg(r0, &(0x7f0000000dc0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001f80)=""/129, 0x81}, 0x2}], 0x1, 0x40002142, 0x0) 14.22978011s ago: executing program 6 (id=2788): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="b31df72dbb4acfc822e3c5e10b43d033833d6a10709740e1bbb4e55e3786153bf781ceec", @ANYRESHEX], 0x28}, 0x1, 0x0, 0x0, 0x8098}, 0x44090) mkdirat(0xffffffffffffff9c, 0x0, 0x68) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x7) sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) syz_open_dev$tty1(0xc, 0x4, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000380)=0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(0xffffffffffffffff, 0x7a4, 0x0) ftruncate(0xffffffffffffffff, 0x2) finit_module(0xffffffffffffffff, 0x0, 0x3) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6004, 0x1) mount(&(0x7f00000001c0)=@filename='./file0\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000001200)='vfat\x00', 0x0, 0x0) io_uring_setup(0x3ef, 0x0) 12.131818067s ago: executing program 6 (id=2790): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0xb2) write$binfmt_misc(r0, &(0x7f0000000100)="99f275", 0xfffffefc) readv(r0, 0x0, 0x0) r1 = syz_io_uring_setup(0x4a5c, &(0x7f0000001040)={0x0, 0xd99d, 0x80, 0x0, 0x3be}, &(0x7f00000010c0), &(0x7f0000001100)) r2 = socket$inet6(0xa, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="65010000"], 0x188}}, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019c80)=""/102400, 0x19000) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x200000fd, @ipv4={'\x00', '\xff\xff', @remote}, 0x5}, 0x1c) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r5, &(0x7f00000000c0)={0x10, 0x0, 0x2, 0x8822d55593a2179}, 0xc) socket$inet6(0xa, 0x3, 0x1) r6 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x103a42, 0x32) ftruncate(r6, 0x6000000) syz_open_procfs(0x0, &(0x7f00000000c0)='smaps\x00') shutdown(0xffffffffffffffff, 0x2) unshare(0x40040000) io_uring_register$IORING_REGISTER_CLOCK(r1, 0x1d, &(0x7f0000001180), 0x0) sched_setscheduler(0xffffffffffffffff, 0x0, &(0x7f0000000000)=0x4) write$FUSE_BMAP(r0, 0x0, 0xffffffffffffff69) 9.293699047s ago: executing program 2 (id=2796): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0x0, 0x806, 0x5, 0xffffffff}, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r4, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r4, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_IOAS_UNMAP$ALL(r3, 0x3b86, &(0x7f0000000080)={0x18, r4}) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r6 = accept4(r5, 0x0, 0x0, 0x80800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000640)=""/88, 0x58}, {&(0x7f0000000740)=""/105, 0xfffffe0b}], 0x2}, 0x0) socket$nl_route(0x10, 0x3, 0x0) write$nci(0xffffffffffffffff, 0x0, 0xfffffeea) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r7, 0x0, 0x80) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000005c0)=ANY=[@ANYRESDEC=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x2000c004}, 0x80) 7.69881605s ago: executing program 5 (id=2801): r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0x9, 0xff1c}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000080)={r1, @in={{0x2, 0x4e21, @loopback}}, 0x4, 0x6}, &(0x7f0000000140)=0x90) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_buf(r2, 0x29, 0x2a, &(0x7f0000000180)="3d48752c5a468d27fe642ec2", 0xc) r3 = syz_io_uring_setup(0x190, &(0x7f00000001c0)={0x0, 0x35e6, 0x80, 0x1, 0x28b}, &(0x7f0000000240), &(0x7f0000000280)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x7, 0x80010, r3, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f00000002c0)={'filter\x00', 0x0, [0x2, 0xe1b, 0x0, 0x5, 0x7]}, &(0x7f0000000340)=0x54) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000380)={{0x2, 0x4e24, @remote}, {0x306, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3d}}, 0x28, {0x2, 0x4e22, @multicast2}, 'macsec0\x00'}) recvmmsg(r0, &(0x7f0000001600)=[{{&(0x7f0000000400)=@l2={0x1f, 0x0, @none}, 0x80, &(0x7f0000001540)=[{&(0x7f0000000480)=""/4096, 0x1000}, {&(0x7f0000001480)=""/156, 0x9c}], 0x2, &(0x7f0000001580)=""/69, 0x45}, 0x3}], 0x1, 0x40, &(0x7f0000001640)) r4 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000001680), 0x2000, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000018c0)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000001940)={0x5, 0x10, 0xfa00, {&(0x7f00000016c0), r5, 0x1}}, 0x18) write(r4, &(0x7f0000001980)="1c4f27cd908e7f4bc4068e419cdb2224f36e1f4ec612c6db1f36ef5c870fd2d216e2138e6a7c9f7bf9f8da15b3ea8dd3a788e01f216ade202a565abbb58df35394b49d802341be4cbe04f2fac0604480aeeac0c58a90ebc1763953e034cacc1bd92ad44a0dbab770b8206fa9b6edc89df18557c6595766cf447462ba02639a1207936066d44ecff6fe8b32ad0fbddac61366a2d8d388360c57d70bd2177bb4550048", 0xa2) getsockopt$bt_hci(r2, 0x0, 0x2, &(0x7f0000001a40)=""/191, &(0x7f0000001b00)=0xbf) write$P9_RREMOVE(r3, &(0x7f0000001b40)={0x7, 0x7b, 0x9}, 0x7) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f0000001cc0)={'filter\x00', 0x0, 0x3, 0xff, [0x3ff, 0x6, 0x7, 0x7, 0x2, 0x6], 0x0, &(0x7f0000001b80), &(0x7f0000001bc0)=""/255}, &(0x7f0000001d40)=0x78) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001dc0), r4) sendmsg$NL80211_CMD_SET_PMKSA(r4, &(0x7f0000001e80)={&(0x7f0000001d80)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000001e40)={&(0x7f0000001e00)={0x38, r6, 0xc10, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x4b}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x25}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040010}, 0x24000) lstat(&(0x7f0000001ec0)='./file0\x00', &(0x7f0000001f00)) r7 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000001f80), 0x20c00, 0x0) r8 = syz_genetlink_get_family_id$team(&(0x7f0000002000), r4) getsockopt$PNPIPE_IFINDEX(r4, 0x113, 0x2, &(0x7f0000002040)=0x0, &(0x7f0000002080)=0x4) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000020c0)={'vxcan1\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r7, &(0x7f0000002300)={&(0x7f0000001fc0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000022c0)={&(0x7f0000002100)={0x194, r8, 0x20, 0x70bd26, 0x25dfdbfb, {}, [{{0x8}, {0x12c, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0xb32}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r10}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}]}}, {{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}]}}]}, 0x194}}, 0x4800) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, &(0x7f0000002340)={"d92b67a20d53fa5b142ae56da2fc18be", 0x0, 0x0, {0x5, 0xa}, {0x9, 0xf}, 0x10, [0x7fffffff, 0x18, 0xb0, 0xfffffffffffffe00, 0x6, 0x4, 0x0, 0x9, 0x6, 0x7fff, 0x3, 0x80, 0x9, 0x1000, 0x2, 0x2]}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000002440)=r11) r12 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r12, 0x8933, &(0x7f0000002480)={'wlan0\x00'}) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000002500)=r7, 0x4) 7.634208754s ago: executing program 5 (id=2802): openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) read(0xffffffffffffffff, &(0x7f0000000900)=""/198, 0xc6) socket(0x40000000015, 0x5, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_OPENQRY(r0, 0x4b46, &(0x7f0000000000)) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f00000002c0)='\x00\x00 \x00\x91]\xc3\xfc.\xd1+\xa3\xb9\xd5\xc1z\xcf\xc7M\x8a\x9c\x00\x00F', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000000314230c2abd7000ff05df250900020073797a310000000008004100727865001400330073797a5f74756e"], 0x38}, 0x1, 0x0, 0x0, 0x48845}, 0x4010) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a310000000054000000030a01020000000000000000010000000900030073797a310000000028000480080002400000000008000140000000051400030076657468315f6d6163767461700000000900010073797a310000000058000000050a01020000000000000000010020000c00024000000000000000010900010073797a3100000000200004801400030076657468315f6d61637674657000000008000140000000050b"], 0xf4}}, 0x0) r3 = openat$sysfs(0xffffff9c, &(0x7f0000000200)='/sys/kernel/notes', 0x0, 0x90) preadv(r3, &(0x7f0000001580)=[{0x0}], 0x1, 0x3324, 0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r5 = accept4(r4, 0x0, 0x0, 0x800) recvmsg(r5, 0x0, 0x0) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000100)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) openat$sysfs(0xffffffffffffff9c, 0x0, 0x14000, 0x0) write$RDMA_USER_CM_CMD_BIND_IP(r6, &(0x7f0000000180)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e26, 0x10001, @local, 0xb}, r7}}, 0x30) write$RDMA_USER_CM_CMD_JOIN_MCAST(r6, &(0x7f0000000900)={0x16, 0x98, 0xfa00, {&(0x7f00000008c0), 0x4, r7, 0x10, 0x0, @in={0x2, 0x6e23, @broadcast}}}, 0xa0) 7.035877867s ago: executing program 5 (id=2803): sendmsg$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, 0x0, 0x400000, 0x0) ioctl$XFS_IOC_EXCHANGE_RANGE(0xffffffffffffffff, 0x40285881, &(0x7f00000000c0)={r0, 0x0, 0xc9, 0x0, 0x7fffffff, 0x8}) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x9, 0x200}, 0x0) timer_create(0x0, 0x0, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000540)={'vcan0\x00', 0x0}) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000380)={0x1d, r1, 0x0, {0x0, 0x1, 0x4}, 0xfe}, 0x18) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000000)="00010100004000", 0x7}, {&(0x7f0000000080)='%y', 0x2}], 0x2}, 0x4004) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0xf09278c5f4147a4d) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000005e00)={0xffffffffffffffff, 0xffffffffffffffff}) syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="120100005f8bfa4099115268345701020301090212000100000000090499", @ANYRES16, @ANYRES64], 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r2, 0x541b, &(0x7f0000000000)={0xffffffffffffffff, 0x4, 0x3, 0x1}) close_range(r3, 0xffffffffffffffff, 0x0) 6.815667806s ago: executing program 2 (id=2805): r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000004c80)={0x0, 0xf3}, &(0x7f0000004d40)=0x8) socket$inet_smc(0x2b, 0x1, 0x0) r4 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d3e457201e040b40e73e000000010902120001000000000904"], 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r4, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r7, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x4, 0x0, 0x32}, 0x9c) pipe(0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000200)={r3, @in={{0x2, 0x4e1c, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x9c) bind$inet6(r7, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r7, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r7, 0x2) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r8, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r8, 0x400448e6, &(0x7f0000000080)='Y') syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xffffffff, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x2, 0x50, 0xd, [{{0x9, 0x4, 0x0, 0x3, 0x1, 0x3, 0x1, 0x3, 0x7f, {0x9, 0x21, 0x6, 0x1, 0x1, {0x22, 0xe91}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x38, 0x0, 0x9}}}}}]}}]}}, &(0x7f00000003c0)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x110, 0xa, 0x7f, 0x6a, 0x60, 0x6}, 0x3d, &(0x7f0000000400)=ANY=[@ANYBLOB="050f3d000514100407fd41d41a5b9c2715872c2eae02c0d18a07100206000d0010100a0841ffffff0f00050026e7e2600a1003020400c209040003100b428f1cba636812f12af354211251a4fb447ad7fee30e3f77807751e97b7265b41c1f22ee8655ffeae0fa65c0d0bf00000000000003f52b7833d99d837ec513b004a9f47856e5cdaec8c0626ded4f57df1ac906343a9c197b7d287a28a0ad8cd45ab2d2defd7e1cb26b4835d565fd168672be17678a0ec8d13d632fcd1bfa25c0b846490283b31f2a224f754ce2f1f3eb0e1d7cdad478855067c4d89d39e805c01a41e50ff2f0e50c6d0eb871528b401d9938cfda7c93583506d5c3abc49fdc183921b2fa8806b8a998d379269d8d33b36072c079201b077da106367d274d4011bdf8c34bf9d52ad3f6893dda0b7197ab040c15885bfc35213336a73190"], 0x2, [{0x73, &(0x7f00000001c0)=@string={0x73, 0x3, "2f73fbdeec3e9df0de6aceb7692199243babc3c406f3b7fd807a4b53e00f56cdf8eb82333f12b6676e883263c2ed8b3939973ce729354e0ec27eedfb88b98414f7da1456c44e830b54702cc1a80788d6840131e4d435793fc8f4d85443b5ad8b978989db069953e673fe114bb3f6b75322"}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0xc04}}]}) r9 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000e40)=ANY=[@ANYBLOB="000086dd0000110000080000000060ec970011a811"], 0x11de) bind$alg(r0, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) 6.612486212s ago: executing program 7 (id=2806): socket$inet6_sctp(0xa, 0x5, 0x84) syz_open_dev$loop(&(0x7f0000000000), 0xf, 0x183043) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) syz_open_dev$loop(&(0x7f0000000300), 0x8f, 0x0) syz_usb_connect(0x0, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="12010102882333404f17cf8af4390102030109024500013f06400409044207000e0100010a240107000105ff010302070724050107638c0924030500030406810c"], 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0xa, 0x5, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='stat\x00') r1 = getpid() syz_pidfd_open(r1, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r0, 0xc040aed5, &(0x7f0000000380)={0xf000, 0x12000}) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r4, @ANYBLOB="1f003300d00000000802110000010802110000005050505050500000", @ANYRES8=r2], 0x3c}}, 0x10) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x1, './file0\x00'}, 0x6e) 6.222087926s ago: executing program 6 (id=2807): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000a40), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)) r2 = syz_io_uring_setup(0x117, &(0x7f0000000400)={0x0, 0x0, 0x10, 0x0, 0x3a2}, &(0x7f00000001c0), &(0x7f0000000000)) io_uring_enter(r2, 0x47f6, 0x80ffff, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_FILES2(r2, 0xd, &(0x7f0000000300)={0x3, 0x1, 0x0, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/153, 0x99}, {&(0x7f0000000000)=""/50, 0x32}, {&(0x7f0000000180)=""/174, 0xae}], &(0x7f00000002c0)=[0x3, 0x1ff]}, 0x20) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.current\x00', 0x26e1, 0x0) close(r4) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$kcm(r4, &(0x7f00000004c0)={&(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, r5, 0x0, 0x3, 0x1, 0x0, {0xa, 0x4e24, 0x2, @private1, 0x7}}}, 0x80, 0x0}, 0x2000f761) ioctl$SIOCSIFHWADDR(r4, 0x8b32, &(0x7f0000000000)={'virt_wifi0\x00', @random="ff80e1e3ec77"}) write$cgroup_devices(r3, &(0x7f00000000c0)=ANY=[], 0xffdd) close(r0) 5.430230501s ago: executing program 7 (id=2808): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0x0, 0x806, 0x5, 0xffffffff}, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r4, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x334e8b}) ioctl$IOMMU_IOAS_UNMAP$ALL(r3, 0x3b86, &(0x7f0000000080)={0x18, r4}) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r6 = accept4(r5, 0x0, 0x0, 0x80800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000640)=""/88, 0x58}, {&(0x7f0000000740)=""/105, 0xfffffe0b}], 0x2}, 0x0) socket$nl_route(0x10, 0x3, 0x0) write$nci(0xffffffffffffffff, 0x0, 0xfffffeea) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r7, 0x0, 0x80) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000005c0)=ANY=[@ANYRESDEC=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x2000c004}, 0x80) 5.386709848s ago: executing program 5 (id=2809): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000440), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25d7dbfb, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0x10, 0xf}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x10, 0x8, 0x8, 0x8, 0x81}, 0x103, 0x0, 0x7, 0x7, 0x7, 0xa, 0x12, 0x7, 0x7, 0x3, {0x3, 0x2, 0x3, 0x35db, 0x2, 0x6}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40188c0}, 0x0) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000022c0)=@newtfilter={0x44, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r6, {0x0, 0x10}, {}, {0x8, 0x4}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1e3a9}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0xc804}, 0x2) close(r4) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}) io_setup(0x5, &(0x7f0000000140)) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000380)={{0x1, 0x1, 0x18}, './file0\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000000300)=""/102400, 0x19000) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}) io_uring_enter(0xffffffffffffffff, 0x47f6, 0x0, 0x0, 0x0, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r3, &(0x7f0000000280)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r9, 0x42}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)="27030200000314000e00003c000300", 0xf}], 0x1}, 0x4005) 3.758646911s ago: executing program 6 (id=2810): r0 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x9}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000000)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f0000000640)=[{{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @dev={0xfe, 0x80, '\x00', 0x40}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000780)=ANY=[@ANYBLOB='\x00'/16], 0x10}}, {{&(0x7f0000000280)=@l2tp6={0xa, 0x0, 0x1, @local, 0x2, 0x1}, 0x80, 0x0}}], 0x2, 0x4000000) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(anubis)\x00'}, 0x58) bind$alg(r1, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'poly1305\x00'}, 0x58) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008a}, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) gettid() r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x2082) read(r3, &(0x7f0000000100)=""/140, 0xde) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r3, 0x4040534e, &(0x7f00000005c0)={0x197, @tick=0x8, 0x0, {}, 0xff, 0x2}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r3, 0xc0605345, &(0x7f00000001c0)={0xfffffff9, 0x2, {0xffffffffffffffff, 0x3, 0x5, 0x0, 0x8}, 0xd51}) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa401) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000f4751f2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b70300000000ff80850000000400000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r4, 0x0, 0x2e, &(0x7f0000000340)={0x23, {{0x2, 0x0, @remote}}, {{0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}}}, 0x108) getsockopt$inet_buf(r4, 0x0, 0x30, &(0x7f0000000340)=""/215, &(0x7f0000000100)=0xd7) 3.742211405s ago: executing program 7 (id=2811): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x2, 0x2}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) r0 = syz_open_dev$MSR(&(0x7f0000000340), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) ptrace$getenv(0x4201, r1, 0x5, &(0x7f0000000080)) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x404c090}, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x11e) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x85) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002240), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002540)='./file0\x00', &(0x7f00000022c0), 0x0, &(0x7f0000000280)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x2000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@allow_other}]}}) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='cgroup\x00') fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000140)={0x1, 0x1, 0x10, 0x40000005}) gettid() timer_create(0x3, 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000380)=0xc) quotactl$Q_SETINFO(0x5debeda840d72afe, &(0x7f0000000100)=@sg0, r5, &(0x7f00000003c0)={0xc6, 0xf494, 0x1}) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x48, &(0x7f0000000000)=0x6, 0x4) setresuid(0x0, 0x0, 0x0) 3.537867443s ago: executing program 7 (id=2812): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000080)='tmpfs\x00', 0x10000, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000140)='./file1\x00') r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) quotactl_fd$Q_SETQUOTA(r2, 0xffffffff80000800, 0x0, &(0x7f00000000c0)={0x0, 0x1, 0x4000000009, 0x2000000009, 0x3, 0xe, 0x48cd, 0xfffffffffffffffc, 0xfff}) 3.474418078s ago: executing program 5 (id=2813): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010101, 0x4e22, 0x3, 'lblcr\x00', 0x1, 0x80005, 0x5}, 0x2c) setsockopt$IP_VS_SO_SET_FLUSH(r2, 0x0, 0x485, 0x0, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0xc0802, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps\x00') lseek(r3, 0x1000000, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000580)="1400000016004163d25a80648c2594f917", 0x11}], 0x1}, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) close_range(r4, 0xffffffffffffffff, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x40081, 0x0) write(0xffffffffffffffff, &(0x7f0000000040), 0x0) r5 = socket(0x10, 0x803, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip6_tables_matches\x00') pread64(r6, &(0x7f00000001c0)=""/170, 0xaa, 0x10000001) read$char_usb(0xffffffffffffffff, &(0x7f00000001c0)=""/4068, 0xfe4) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(0xffffffffffffffff, 0x7a5, &(0x7f0000000040)={{@any, 0x4}, 0x1, 0x0, 0x3}) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000140)={'veth0_to_team\x00', &(0x7f0000000280)=@ethtool_channels={0x3d, 0x0, 0x0, 0x0, 0x4, 0x2, 0x1}}) 2.698266405s ago: executing program 6 (id=2814): r0 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_LINK_SET(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)=ANY=[@ANYBLOB='8\x00\x00', @ANYRES16=r0, @ANYBLOB="0106000000000000000008000000240004801300010062726f6164636173742d6c696e6b08"], 0x38}, 0x1, 0x0, 0x0, 0x24004005}, 0x448c0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYRESDEC], 0x30}}, 0xa890) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000100)={'team0\x00', 0x0}) lsetxattr$security_selinux(&(0x7f00000001c0)='.\x00', &(0x7f0000000240), &(0x7f0000000280)='system_u:object_r:fsadm_exec_t:s0\x00', 0x12, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000014c0)=@newtaction={0x68, 0x30, 0xb, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x6a00}, [{0x54, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x6, 0xff, 0x4, 0x6, 0x6}, 0x4, r4}}]}, {0x4, 0xa}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x2000a804) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000500)=0x6) io_setup(0x2, &(0x7f0000001200)) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) r7 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r7, 0x29, 0x19, &(0x7f0000000100)=0x1, 0x4) setresuid(0x0, 0xee01, 0xffffffffffffffff) clock_adjtime(0x17, &(0x7f00000001c0)={0xffffffff, 0x400000000000040, 0xb, 0x0, 0x1, 0x1, 0x0, 0xfffffffffffffffd, 0xc4ed, 0xffffffffffffffff, 0x1, 0x0, 0x8, 0x1, 0x0, 0xe5a, 0x6, 0x5, 0x3, 0xffffffffffffffff, 0x6, 0x4, 0x0, 0x0, 0x88000000, 0x400000}) r8 = msgget$private(0x0, 0x0) msgctl$IPC_SET(r8, 0x1, &(0x7f0000258f88)={{0x1, 0x0, 0x0, 0x0, 0x0, 0x80}, 0x0, 0x0, 0x6b, 0x0, 0x0, 0x0, 0x5}) msgsnd(r8, &(0x7f0000000240)=ANY=[], 0x0, 0x0) msgctl$IPC_SET(r8, 0x1, &(0x7f0000000140)={{0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x5, 0x20}) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000000180)=ANY=[@ANYBLOB="0200000001000000000000000400000000000000080000000000000020"], 0x24, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff010000000000000000000000000001000000003c000000ac14141f000000000000000000000000000000000000000000b40000000080000c00000000000000000000000000000000000000000000000000000000000000e5d9ffffffffffff0000000000000000000000000000000000002000000000000700000000000000fdffffffffffffff00000400000000000900000000000000000000000a000200700000000000000014000e00fe80000000"], 0x104}}, 0x44800) 2.236073816s ago: executing program 7 (id=2815): bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0200000004000000040000000800000014100000", @ANYRES32, @ANYBLOB='\x00'/18, @ANYBLOB], 0x50) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000000)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0xfffffffe, @local, 0x1}, 0x1c) rt_sigqueueinfo(r0, 0x22, &(0x7f0000000300)={0x15, 0x8, 0x5}) syz_emit_vhci(0x0, 0x7) sendmmsg(r3, &(0x7f0000000480), 0x2e9, 0x0) 2.215356524s ago: executing program 2 (id=2816): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="0000000000004a641c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010001fff0000000001000000000000d7", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800a000100767863616e0000000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) socket(0x1, 0x803, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x60, &(0x7f0000000300)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c00000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800b0001006772657461700000240002800800070064010100060003001008000008001500700f0d0008000700ac1414bb08000a00", @ANYRES32=r7], 0x5c}}, 0x40) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}]}}}, @IFLA_LINK={0x8, 0x5, r8}, @IFLA_MASTER={0x8, 0xa, r8}]}, 0x4c}}, 0x884) 1.942872047s ago: executing program 6 (id=2817): socket$inet6_sctp(0xa, 0x5, 0x84) syz_open_dev$loop(&(0x7f0000000000), 0xf, 0x183043) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) syz_open_dev$loop(&(0x7f0000000300), 0x8f, 0x0) syz_usb_connect(0x0, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="12010102882333404f17cf8af4390102030109024500013f06400409044207000e0100010a240107000105ff010302070724050107638c0924030500030406810c"], 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0xa, 0x5, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='stat\x00') r1 = getpid() syz_pidfd_open(r1, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r0, 0xc040aed5, &(0x7f0000000380)={0xf000, 0x12000}) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r4, @ANYBLOB="1f003300d00000000802110000010802110000005050505050500000", @ANYRES8=r2], 0x3c}}, 0x10) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x1, './file0\x00'}, 0x6e) 1.246644826s ago: executing program 5 (id=2818): sendmsg$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, 0x0, 0x400000, 0x0) ioctl$XFS_IOC_EXCHANGE_RANGE(0xffffffffffffffff, 0x40285881, &(0x7f00000000c0)={r0, 0x0, 0xc9, 0x0, 0x7fffffff, 0x8}) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x9, 0x200}, 0x0) timer_create(0x0, 0x0, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000540)={'vcan0\x00', 0x0}) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000380)={0x1d, r1, 0x0, {0x0, 0x1, 0x4}, 0xfe}, 0x18) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000000)="00010100004000", 0x7}, {&(0x7f0000000080)='%y', 0x2}], 0x2}, 0x4004) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0xf09278c5f4147a4d) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000005e00)={0xffffffffffffffff, 0xffffffffffffffff}) syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="120100005f8bfa4099115268345701020301090212000100000000090499", @ANYRES16, @ANYRES64], 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r2, 0x541b, &(0x7f0000000000)={0xffffffffffffffff, 0x4, 0x3, 0x1}) close_range(r3, 0xffffffffffffffff, 0x0) 1.133211989s ago: executing program 7 (id=2819): syz_usb_connect(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000a72b7a104c05e102c8e201020301090224000100000000090471020216fa1f0009051402100000fa0009058202", @ANYBLOB="6ba859"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x94) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setresgid(0x0, 0xee01, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000080), 0x8000, &(0x7f00000024c0)=ANY=[@ANYBLOB='quota']) r3 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file2\x00', 0x341942, 0x1f9) quotactl_fd$Q_GETNEXTQUOTA(r3, 0xffffffff80000901, 0xee00, 0x0) getrusage(0xffffffffffffffff, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12e9ffff0300000004e700001200020400000000", @ANYRES32, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000040)=ANY=[@ANYRES32=r5, @ANYRES32, @ANYBLOB='\x00\x00\x00', @ANYRES32, @ANYBLOB, @ANYRES64=0x0], 0x10) getsockopt$EBT_SO_GET_INIT_INFO(r3, 0x0, 0x82, &(0x7f00000000c0)={'nat\x00', 0x0, 0x0, 0x0, [0x2, 0x3208, 0x306db82b, 0x10, 0x7a4f]}, &(0x7f0000000140)=0x78) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000a80)={0xffffffffffffffff, &(0x7f0000000940), &(0x7f0000000a40)=@tcp6}, 0x20) shutdown(r4, 0x0) recvmmsg(r4, &(0x7f0000000300)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000b80)=""/4119, 0x1017}], 0x1}}], 0x1, 0x4002, 0x0) 513.683117ms ago: executing program 2 (id=2820): sendmsg$NFNL_MSG_CTHELPER_NEW(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="50000000000905000000000000000000030000020900010073797a3100000000300002002c000180140003000000ab4b5f67aac6cf8eff000000000014000400ff020000000000000000000000000001"], 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x6d93, 0x4) sendmsg$sock(r0, &(0x7f0000000540)={&(0x7f0000000580)=@in6={0xa, 0x4e27, 0x81, @mcast1, 0x7}, 0x80, 0x0, 0x0, &(0x7f0000000700)=[@mark={{0x14, 0x1, 0x51, 0xfffffffb}}], 0x18}, 0x20440c4) r1 = syz_open_dev$audion(0x0, 0x3, 0x1) write$uinput_user_dev(r1, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0) cachestat(r2, &(0x7f0000000040)={0x7e}, &(0x7f0000000140), 0x0) recvfrom(0xffffffffffffffff, 0x0, 0x14, 0x40018020, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) inotify_init1(0x800) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r3, &(0x7f0000000380)={{0x6, @rose, 0x1}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}, 0x48) r4 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) bind$netrom(r4, &(0x7f00000004c0)={{0x6, @rose, 0x6}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}, 0x48) listen(r4, 0x80) 130.973136ms ago: executing program 2 (id=2821): socket$packet(0x11, 0x3, 0x300) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) r1 = socket$kcm(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) socketpair$unix(0x1, 0x2, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x4) write(r2, &(0x7f00000007c0)="2700000014000707030e0000120f0a0011000100f5fe0012ff000000078a151f75080039000500758a77784e54a2a9fa6905354be7a0e7c7698d0d85142895d047db2d9b841c65e9c092f1af9c601868a83bf2d2506add1e5c93fab38382ab0fcb9d6e764e3a4fd790c019829a5a59796ea51a7eb2e861b7cd7b77382be2b49fd1da4c587c11108097b7e112f2e0a7baaceef07f2bfaa926fdc86c2311551ae7c1b881363eadf8ef47d8d81ab1abea615e0b345fd9187cc04b4a1c68e1318ffddaf97bf9ae94ba9ef430b42847238b9b12d876a5e52ef8804d1eb5356925960bc1bbc26ccf10b9982f361d2975d41d596999869ebd2ca7d95ccd5f161b75cbefbae4470d9f9cc853145f11b93eb3dc8ff49d0147253c47abbadeb9613588629293c1ce35a9239f3eb93c1495c00f3ddd69734cfcf50f0bd97ce8fd55e6705967e66fe1b08bd4dc16faebde5ef8a8a308223e1e6c2de52094a2943b6d775b43f1ba9e86963cb65f695e67", 0x16a) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev, 0xe0000000}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) write$vhost_msg_v2(r0, &(0x7f0000000200)={0x2, 0x0, {0x0, 0x0, 0x0, 0x2, 0x2}}, 0x48) 0s ago: executing program 2 (id=2822): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) recvmmsg(r0, &(0x7f0000006c00)=[{{&(0x7f0000000240)=@hci, 0x80, &(0x7f0000001700)=[{&(0x7f00000002c0)=""/223, 0xdf}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/120, 0x78}, {&(0x7f0000001440)=""/103, 0x67}, {&(0x7f00000014c0)=""/142, 0x8e}, {&(0x7f0000001580)=""/237, 0xed}, {&(0x7f0000001680)=""/90, 0x5a}], 0x7, &(0x7f0000000140)=""/28, 0x1c}, 0x7fffffff}, {{&(0x7f0000001780)=@hci, 0x80, &(0x7f00000018c0)=[{&(0x7f0000001800)=""/165, 0xa5}], 0x1, &(0x7f0000001900)=""/230, 0xe6}, 0xf32}, {{&(0x7f0000001a00)=@l2tp6={0xa, 0x0, 0x0, @local}, 0x80, &(0x7f0000002080)=[{&(0x7f0000001a80)=""/116, 0x74}, {&(0x7f0000001b00)=""/19, 0x13}, {&(0x7f0000001b40)=""/227, 0xe3}, {&(0x7f0000001c40)=""/98, 0x62}, {&(0x7f0000001cc0)=""/122, 0x7a}, {&(0x7f0000001d40)=""/160, 0xa0}, {&(0x7f0000001e00)=""/158, 0x9e}, {&(0x7f0000007140)=""/158, 0x9e}, {&(0x7f0000001f80)=""/231, 0xe7}], 0x9, &(0x7f0000002140)=""/32, 0x20}, 0x72a1}, {{&(0x7f0000002200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x80, &(0x7f0000007080)=[{&(0x7f0000002280)=""/95, 0x5f}, {&(0x7f0000002300)=""/226, 0xe2}, {&(0x7f0000002400)=""/252, 0xfc}, {&(0x7f0000002500)=""/233, 0xe9}, {&(0x7f0000002600)=""/167, 0xa7}, {&(0x7f0000002180)=""/6, 0x6}, {&(0x7f00000026c0)=""/84, 0x54}, {&(0x7f0000006f00)=""/111, 0x6f}, {&(0x7f0000007000)=""/72, 0x48}], 0x9, &(0x7f00000027c0)=""/127, 0x7f}, 0x10000}, {{0x0, 0x0, &(0x7f0000002d00)=[{&(0x7f0000002840)=""/99, 0x63}, {&(0x7f00000028c0)=""/227, 0xe3}, {&(0x7f0000006e40)=""/138, 0x8a}, {&(0x7f0000002a80)=""/221, 0xdd}, {&(0x7f0000002b80)=""/217, 0xd9}, {&(0x7f0000002c80)=""/108, 0x6c}], 0x6, &(0x7f0000002d80)=""/4096, 0x1000}}, {{&(0x7f0000001f00)=@ieee802154, 0x80, &(0x7f0000002a40)=[{&(0x7f0000003e00)=""/233, 0xe9}, {&(0x7f0000007200)=""/190, 0xbe}], 0x2, &(0x7f0000003f40)=""/186, 0xba}, 0x7}, {{&(0x7f0000004000)=@rc, 0x80, &(0x7f0000006440)=[{&(0x7f0000004080)=""/4096, 0x1000}, {&(0x7f0000005080)=""/215, 0xd7}, {&(0x7f0000001ec0)=""/34, 0x22}, {&(0x7f00000051c0)=""/4096, 0x1000}, {&(0x7f00000061c0)=""/71, 0x47}, {&(0x7f0000006240)=""/252, 0xfc}, {&(0x7f0000006340)=""/248, 0xf8}], 0x7, &(0x7f00000064c0)=""/173, 0xad}, 0x8}, {{&(0x7f0000006580)=@in6={0xa, 0x0, 0x0, @mcast2}, 0x80, &(0x7f0000006ac0)=[{&(0x7f0000006600)=""/17, 0x11}, {&(0x7f0000006640)=""/173, 0xad}, {&(0x7f0000006700)=""/105, 0x69}, {&(0x7f0000006780)=""/170, 0xaa}, {&(0x7f0000006840)=""/146, 0x92}, {&(0x7f0000006900)=""/17, 0x11}, {&(0x7f0000006940)=""/129, 0x81}, {&(0x7f0000006a00)}, {&(0x7f0000006a40)=""/84, 0x54}], 0x9, &(0x7f0000006b80)=""/79, 0x4f}, 0x79f}], 0x8, 0x40010121, &(0x7f0000006e00)={0x0, 0x989680}) mkdir(&(0x7f00000001c0)='./file0\x00', 0x21) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mkdir(&(0x7f0000000200)='./bus\x00', 0x10) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000021c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chroot(&(0x7f0000000000)='./bus\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) close(0x4) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) mount(&(0x7f0000000140)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='xfs\x00', 0x2208004, 0x0) r4 = open(&(0x7f00000003c0)='.\x00', 0x100, 0x97) getdents(r4, &(0x7f0000001fc0)=""/184, 0xb8) write$binfmt_script(0xffffffffffffffff, &(0x7f00000072c0)={'#! ', './cgroup', [{0x20, 'syzkaller0\x00'}, {0x20, '/dev/nullb0\x00'}, {0x20, 'veth1_to_bridge\x00'}], 0xa, "2bb36dcb508c3770d8cb1413fde0870994ea6f48d5cab3698f5b1985cd7fd41e0e724914f12d133b92720762448caf35e0c196abe10afe19a8e8dc982c025a22ef1766658f6d6a89b94f6c89a2b42e61399589eba8406b9539bd19df3d77028978a220a318b10c8e615f8967b7a07a8aaa244641576fdb21bf99e14bb372a2f93f4f14a2fdb70d3e06fda85217406e1190001e9765056811ea1326dba0ab14d84a482fe826ec7b323eac7f2613372964407efae75d907cb5314b5f834a4b778b"}, 0xf6) r5 = socket$unix(0x1, 0x5, 0x0) socket$kcm(0x29, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) openat$sysfs(0xffffffffffffff9c, &(0x7f0000003d80)='/sys/power/pm_async', 0x20000, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) syz_emit_ethernet(0x86, &(0x7f00000002c0)=ANY=[@ANYBLOB="7757dcd5aaaabbbbbbbbbbbb0800454f00780067000001019078ac1e0101ac1414aa0400907800000000471000030067000703018001ac1414bbac1414aa89034e444439317f000001000000087f000001000006a464010102000007ffac1414bb000000070a010101000004ace000000100000002ac1e000100000004ffffffff0000006d00"], 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000002740)={&(0x7f0000000140)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r6, {0x4, 0xd}, {}, {0xfff3, 0xfff3}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_FLAGS={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x22044028}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r1) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000c80)={'veth1_to_bridge\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r9, {0x0, 0x2}, {0xffff, 0xffff}, {0x10}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x4}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xa5, 0x2, 0xfff7, 0x6, 0x1, 0x7ff, 0x9c}}, {0x4}}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x51}, 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x40, 0x0) kernel console output (not intermixed with test programs): o=45972 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 675.908402][T14126] 9pnet_virtio: no channels available for device ./bus [ 676.256309][T14134] overlayfs: failed to resolve './file1': -2 [ 676.815337][T11789] Bluetooth: hci2: unexpected event 0x2f length: 509 > 260 [ 678.266090][ T978] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 678.510233][ T978] usb 5-1: unable to get BOS descriptor or descriptor too short [ 678.545429][ T978] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 678.823732][ T978] usb 5-1: can't read configurations, error -71 [ 679.017782][T14177] netlink: 1752 bytes leftover after parsing attributes in process `syz.6.2197'. [ 679.638192][T14181] ieee802154 phy0 wpan0: encryption failed: -22 [ 679.644821][ T30] audit: type=1400 audit(1771332460.491:1506): avc: denied { write } for pid=14180 comm="syz.5.2199" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 680.188086][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 680.194535][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 680.253486][ T978] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 680.424022][ T978] usb 5-1: Using ep0 maxpacket: 8 [ 680.439703][ T978] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 680.461503][ T978] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 680.492879][ T978] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 680.523579][ T30] audit: type=1400 audit(1771332461.372:1507): avc: denied { setopt } for pid=14195 comm="syz.5.2203" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 680.543660][ T978] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 680.556892][ T978] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 680.580228][ T978] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 680.941463][ T978] usb 5-1: usb_control_msg returned -32 [ 680.950004][ T978] usbtmc 5-1:16.0: can't read capabilities [ 681.440130][ T30] audit: type=1400 audit(1771332462.302:1508): avc: denied { shutdown } for pid=14204 comm="syz.6.2204" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 682.180701][ T30] audit: type=1400 audit(1771332463.043:1509): avc: denied { read } for pid=14215 comm="syz.2.2208" path="socket:[47431]" dev="sockfs" ino=47431 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 682.232799][ T5817] Bluetooth: hci4: command 0x0406 tx timeout [ 682.351814][ T978] usb 5-1: USB disconnect, device number 79 [ 682.394421][T11789] Bluetooth: hci3: unexpected event 0x2f length: 509 > 260 [ 682.410920][T14219] No control pipe specified [ 682.411946][T14223] 9pnet_fd: Insufficient options for proto=fd [ 682.587175][ T5861] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 682.736846][T14228] netlink: 1752 bytes leftover after parsing attributes in process `syz.4.2211'. [ 682.928675][ T5861] usb 3-1: Using ep0 maxpacket: 8 [ 682.963233][ T5861] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 682.982060][ T5861] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 683.002950][ T5861] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 683.018619][ T5861] usb 3-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 683.028101][ T5861] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 683.041505][T14232] 9p: Bad value for 'wfdno' [ 683.046330][ T5861] usb 3-1: Product: syz [ 683.051041][ T5861] usb 3-1: Manufacturer: syz [ 683.056678][ T5861] usb 3-1: SerialNumber: syz [ 683.065138][ T5861] usb 3-1: config 0 descriptor?? [ 683.078349][T14221] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 683.145212][ T5861] rc_core: IR keymap rc-streamzap not found [ 683.156885][ T5861] Registered IR keymap rc-empty [ 683.163381][ T5861] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 683.177726][ T5861] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input38 [ 683.329966][T14221] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 683.339425][T14221] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 684.597252][T14264] netlink: 1752 bytes leftover after parsing attributes in process `syz.4.2223'. [ 684.984877][T14268] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 684.992235][T14270] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2224'. [ 685.042414][T14270] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2224'. [ 685.191106][ T978] usb 3-1: USB disconnect, device number 61 [ 685.224266][T14270] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2224'. [ 685.281101][T14274] ucma_write: process 654 (syz.5.2224) changed security contexts after opening file descriptor, this is not allowed. [ 685.296844][T14275] lo speed is unknown, defaulting to 1000 [ 685.311061][T14270] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2224'. [ 685.316234][ T30] audit: type=1400 audit(1771332466.174:1510): avc: denied { mounton } for pid=14265 comm="syz.5.2224" path="/187/file0" dev="tmpfs" ino=1049 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 685.362802][T14270] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2224'. [ 685.690976][ T978] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 685.734648][T14284] Invalid logical block size (16646144) [ 685.818468][T14287] netlink: 'syz.4.2229': attribute type 1 has an invalid length. [ 685.847301][T14287] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 685.860453][ T978] usb 3-1: too many configurations: 53, using maximum allowed: 8 [ 685.875156][T14287] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 685.931052][ T978] usb 3-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 685.940128][ T978] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 685.952653][ T978] usb 3-1: Product: syz [ 685.956862][ T978] usb 3-1: Manufacturer: syz [ 685.963221][ T978] usb 3-1: SerialNumber: syz [ 686.587350][ T2767] block nbd0: Possible stuck request ffff888027d70000: control (read@0,4096B). Runtime 180 seconds [ 686.707330][T14298] netlink: 'syz.6.2231': attribute type 10 has an invalid length. [ 686.716602][T14298] netlink: 40 bytes leftover after parsing attributes in process `syz.6.2231'. [ 688.199426][ T978] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 688.241981][ T978] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 688.537401][ T978] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 689.109332][ T978] lan78xx 3-1:1.0: probe with driver lan78xx failed with error -71 [ 689.265737][ T978] usb 3-1: USB disconnect, device number 62 [ 689.486543][T14314] netlink: 'syz.2.2236': attribute type 1 has an invalid length. [ 689.753686][T14310] lo speed is unknown, defaulting to 1000 [ 689.813484][T14316] bond4: (slave vxcan1): The slave device specified does not support setting the MAC address [ 689.856807][T14316] bond4: (slave vxcan1): Error -95 calling set_mac_address [ 689.931826][T14314] bond4: (slave gretap1): making interface the new active one [ 689.947084][T14314] bond4: (slave gretap1): Enslaving as an active interface with an up link [ 691.157992][T13571] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 691.309994][T13571] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 691.318716][T13571] usb 3-1: config 0 has no interface number 0 [ 691.327461][T13571] usb 3-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 691.339046][T13571] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 691.351727][T13571] usb 3-1: Product: syz [ 691.357112][T13571] usb 3-1: Manufacturer: syz [ 691.369606][T13571] usb 3-1: SerialNumber: syz [ 691.433100][T13571] usb 3-1: config 0 descriptor?? [ 691.799548][T13571] dvb_usb_ec168 3-1:0.1: probe with driver dvb_usb_ec168 failed with error -71 [ 691.817361][T13571] usb 3-1: USB disconnect, device number 63 [ 691.944027][T14349] netlink: 'syz.6.2246': attribute type 1 has an invalid length. [ 692.135237][T14352] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 692.194386][T14352] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 692.463648][ T30] audit: type=1326 audit(1771332473.328:1511): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14361 comm="syz.2.2249" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda6eb9bf79 code=0x7ffc0000 [ 692.491317][ T30] audit: type=1326 audit(1771332473.328:1512): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14361 comm="syz.2.2249" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda6eb9bf79 code=0x7ffc0000 [ 692.542611][T14349] bond1: (slave gretap1): making interface the new active one [ 692.570345][T14349] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 692.587315][ T5875] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 692.591728][T14353] macvlan2: entered promiscuous mode [ 692.616314][T14353] macvlan2: entered allmulticast mode [ 692.632767][T14353] bond1: entered promiscuous mode [ 692.643205][T14353] gretap1: entered promiscuous mode [ 692.649326][T14353] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 692.659884][T14353] bond1: (slave macvlan2): the slave hw address is in use by the bond; giving it the hw address of gretap1 [ 692.685424][T14353] bond1: left promiscuous mode [ 692.690674][ T5861] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 692.698549][T14353] gretap1: left promiscuous mode [ 692.737333][ T5826] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 692.758690][ T5875] usb 6-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 692.768829][ T5875] usb 6-1: config 0 interface 0 has no altsetting 0 [ 692.780817][ T5875] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 692.790986][ T5875] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 692.799710][ T5875] usb 6-1: Product: syz [ 692.804147][ T5875] usb 6-1: Manufacturer: syz [ 692.809979][ T5875] usb 6-1: SerialNumber: syz [ 692.827765][ T5875] usb 6-1: config 0 descriptor?? [ 692.835497][ T5875] usb 6-1: selecting invalid altsetting 0 [ 692.867175][ T5861] usb 5-1: Using ep0 maxpacket: 32 [ 692.874117][ T5861] usb 5-1: config 2 has an invalid interface number: 230 but max is 0 [ 692.888084][ T5861] usb 5-1: config 2 has no interface number 0 [ 692.917636][ T5826] usb 3-1: Using ep0 maxpacket: 32 [ 692.922925][ T5861] usb 5-1: config 2 interface 230 altsetting 0 endpoint 0xA has invalid maxpacket 1584, setting to 1024 [ 692.951270][ T5861] usb 5-1: New USB device found, idVendor=6737, idProduct=0001, bcdDevice=a4.72 [ 692.960571][ T5861] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 692.968903][ T5826] usb 3-1: New USB device found, idVendor=04b4, idProduct=ed81, bcdDevice= 0.00 [ 692.980371][ T5826] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 692.995075][T14365] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 693.006777][ T5826] usb 3-1: config 0 descriptor?? [ 693.073579][T14363] netlink: 44 bytes leftover after parsing attributes in process `syz.5.2248'. [ 693.094972][ T5890] usb 6-1: USB disconnect, device number 41 [ 693.536038][ T5826] cypress 0003:04B4:ED81.001B: item fetching failed at offset 5/7 [ 693.545500][ T5826] cypress 0003:04B4:ED81.001B: parse failed [ 693.552038][ T5826] cypress 0003:04B4:ED81.001B: probe with driver cypress failed with error -22 [ 694.253835][T14377] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 694.262709][T14377] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 694.285203][ T30] audit: type=1326 audit(1771332474.779:1513): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14361 comm="syz.2.2249" exe="/root/syz-executor" sig=0 arch=c000003e syscall=270 compat=0 ip=0x7fda6eb9bf79 code=0x7ffc0000 [ 694.516989][T14385] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2254'. [ 695.704975][ T5890] usb 3-1: USB disconnect, device number 64 [ 695.721814][ T5861] usb 5-1: string descriptor 0 read error: -71 [ 695.737977][ T5861] cypress_m8 5-1:2.230: HID->COM RS232 Adapter converter detected [ 695.883373][ T5861] usb 5-1: HID->COM RS232 Adapter converter now attached to ttyUSB0 [ 695.903782][ T5861] usb 5-1: USB disconnect, device number 80 [ 695.954000][ T5861] cyphidcom ttyUSB0: HID->COM RS232 Adapter converter now disconnected from ttyUSB0 [ 696.046174][ T30] audit: type=1400 audit(1771332476.920:1514): avc: denied { getopt } for pid=14407 comm="syz.4.2260" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 696.079976][ T5861] cypress_m8 5-1:2.230: device disconnected [ 696.102801][T14406] syzkaller0: entered promiscuous mode [ 696.108374][T14406] syzkaller0: entered allmulticast mode [ 696.280584][T14411] netlink: 'syz.4.2260': attribute type 1 has an invalid length. [ 696.288511][T14411] netlink: 280 bytes leftover after parsing attributes in process `syz.4.2260'. [ 696.934519][T14413] rdma_rxe: rxe_newlink: failed to add syz_tun [ 696.954812][T14415] xt_hashlimit: size too large, truncated to 1048576 [ 697.157689][T14421] netlink: 207952 bytes leftover after parsing attributes in process `syz.0.2262'. [ 697.179871][T14418] netlink: 44 bytes leftover after parsing attributes in process `syz.6.2263'. [ 697.209782][T11789] Bluetooth: hci2: unexpected event for opcode 0x2024 [ 697.222578][T14421] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2262'. [ 697.235359][T14421] bridge0: port 1(bridge_slave_0) entered disabled state [ 697.260465][T14421] bridge_slave_0 (unregistering): left allmulticast mode [ 697.268555][T14421] bridge_slave_0 (unregistering): left promiscuous mode [ 697.276961][T14421] bridge0: port 1(bridge_slave_0) entered disabled state [ 699.023844][T14442] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2268'. [ 699.033793][T14442] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2268'. [ 699.107668][T14444] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=14444 comm=syz.6.2269 [ 699.815497][T14453] netlink: 'syz.4.2271': attribute type 10 has an invalid length. [ 699.823706][T14453] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2271'. [ 700.635071][T14458] syzkaller0: entered promiscuous mode [ 700.640636][T14458] syzkaller0: entered allmulticast mode [ 701.040353][T14468] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 702.661635][T14484] binder: 14481:14484 ioctl 4018620d 0 returned -22 [ 702.772277][T14489] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 702.835250][T14492] netlink: 'syz.6.2282': attribute type 1 has an invalid length. [ 703.049923][T14492] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 703.079991][T14492] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 703.153399][T14500] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2283'. [ 703.668341][T14499] macvlan2: entered promiscuous mode [ 703.673823][T14499] macvlan2: entered allmulticast mode [ 703.682722][T14499] bond2: entered promiscuous mode [ 703.697971][T14499] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 703.820096][T14499] bond2: left promiscuous mode [ 704.661475][ T5826] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 704.879774][ T30] audit: type=1400 audit(1771332486.748:1515): avc: denied { accept } for pid=14511 comm="syz.6.2287" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 704.892647][ T5826] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 704.917550][ T5826] usb 6-1: config 0 has no interface number 0 [ 704.943869][ T5826] usb 6-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 704.954497][ T5826] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 704.971294][ T5826] usb 6-1: Product: syz [ 705.000803][ T5826] usb 6-1: Manufacturer: syz [ 705.102768][ T5826] usb 6-1: SerialNumber: syz [ 705.282962][ T5826] usb 6-1: config 0 descriptor?? [ 705.590781][ T5826] usb 6-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 705.650784][ T5826] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 705.691596][ T5826] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 705.721367][ T5826] usb 6-1: media controller created [ 705.766758][ T5826] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 706.803830][ T5861] usb 6-1: USB disconnect, device number 42 [ 707.040154][T14533] syzkaller0: entered promiscuous mode [ 707.045668][T14533] syzkaller0: entered allmulticast mode [ 708.226559][ T30] audit: type=1400 audit(1771332490.100:1516): avc: denied { unmount } for pid=12388 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 708.394870][T14548] netlink: 'syz.6.2297': attribute type 1 has an invalid length. [ 708.447880][T14548] bond3: (slave vxcan3): The slave device specified does not support setting the MAC address [ 708.490850][T14548] bond3: (slave vxcan3): Error -95 calling set_mac_address [ 708.958527][T14552] macvlan2: entered promiscuous mode [ 709.019007][T14552] macvlan2: entered allmulticast mode [ 709.025100][T14552] bond3: entered promiscuous mode [ 709.039578][T14552] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 709.148602][T14552] bond3: left promiscuous mode [ 709.283772][T14558] netlink: 'syz.5.2299': attribute type 10 has an invalid length. [ 709.291818][T14558] netlink: 40 bytes leftover after parsing attributes in process `syz.5.2299'. [ 710.147120][T14571] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2303'. [ 713.423434][T14619] serio: Serial port ttyS3 [ 714.365258][T14634] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=37 sclass=netlink_tcpdiag_socket pid=14634 comm=syz.5.2316 [ 715.435236][T14647] /dev/nullb0: Can't open blockdev [ 715.458463][T14648] comedi comedi4: bad chanlist[0]=0x00000c7e chan=3198 range length=2 [ 715.498467][ T30] audit: type=1400 audit(1771332497.383:1517): avc: denied { shutdown } for pid=14645 comm="syz.4.2321" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 715.520148][ T30] audit: type=1400 audit(1771332497.403:1518): avc: denied { write } for pid=14645 comm="syz.4.2321" path="socket:[49679]" dev="sockfs" ino=49679 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 716.616621][ T2767] block nbd0: Possible stuck request ffff888027d70000: control (read@0,4096B). Runtime 210 seconds [ 717.204965][ T5861] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 718.014516][ T5861] usb 3-1: Using ep0 maxpacket: 32 [ 718.143468][ T5861] usb 3-1: unable to get BOS descriptor or descriptor too short [ 718.543113][T14681] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=14681 comm=syz.5.2330 [ 718.558775][ T5861] usb 3-1: config 0 has an invalid interface number: 11 but max is 0 [ 718.614661][ T5861] usb 3-1: config 0 has no interface number 0 [ 718.642207][ T30] audit: type=1400 audit(1771332500.505:1519): avc: denied { cmd } for pid=14680 comm="syz.5.2330" path="socket:[49717]" dev="sockfs" ino=49717 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 718.674745][ T5861] usb 3-1: config 0 interface 11 has no altsetting 0 [ 718.730019][ T5861] usb 3-1: New USB device found, idVendor=07b0, idProduct=0006, bcdDevice=13.a1 [ 718.767082][ T5861] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 718.845471][ T5861] usb 3-1: Product: syz [ 718.849664][ T5861] usb 3-1: Manufacturer: syz [ 718.873995][ T5861] usb 3-1: SerialNumber: syz [ 718.883789][ T5861] usb 3-1: config 0 descriptor?? [ 719.328326][T14667] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 719.968521][T14702] kvm: vcpu 2: requested 128 ns lapic timer period limited to 200000 ns [ 719.978332][T14702] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 720.954854][ T5861] HFC-S_USB 3-1:0.11: probe with driver HFC-S_USB failed with error -5 [ 720.994381][ T5861] usb 3-1: USB disconnect, device number 65 [ 721.889118][T14736] netlink: 212408 bytes leftover after parsing attributes in process `syz.5.2349'. [ 721.927388][ T5817] Bluetooth: hci1: unexpected event for opcode 0x1005 [ 722.085380][ T30] audit: type=1400 audit(1771332503.807:1520): avc: denied { getopt } for pid=14734 comm="syz.5.2349" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 723.290486][T14747] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2352'. [ 723.731923][ T5817] Bluetooth: hci4: command 0x0406 tx timeout [ 724.061882][T13571] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 724.303927][T13571] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 959 [ 724.314046][T13571] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 724.833112][T13571] usb 5-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice=e5.38 [ 724.851510][T13571] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 724.859561][T13571] usb 5-1: Product: syz [ 724.871099][T13571] usb 5-1: Manufacturer: syz [ 724.875733][T13571] usb 5-1: SerialNumber: syz [ 724.890578][T13571] usb 5-1: config 0 descriptor?? [ 724.939401][T14747] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 725.000421][T14778] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2361'. [ 725.069194][T11988] netdevsim netdevsim6 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 725.069299][T14778] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2361'. [ 725.081193][T11988] netdevsim netdevsim6 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 725.164826][T11988] netdevsim netdevsim6 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 725.239499][T11988] netdevsim netdevsim6 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 725.291849][T13571] usb 5-1: USB disconnect, device number 81 [ 725.335974][T14780] FAULT_INJECTION: forcing a failure. [ 725.335974][T14780] name failslab, interval 1, probability 0, space 0, times 0 [ 725.385616][T14780] CPU: 0 UID: 0 PID: 14780 Comm: syz.6.2363 Tainted: G L syzkaller #0 PREEMPT(full) [ 725.385649][T14780] Tainted: [L]=SOFTLOCKUP [ 725.385655][T14780] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 725.385664][T14780] Call Trace: [ 725.385670][T14780] [ 725.385676][T14780] dump_stack_lvl+0x100/0x190 [ 725.385708][T14780] should_fail_ex.cold+0x5/0xa [ 725.385731][T14780] should_failslab+0xc2/0x120 [ 725.385755][T14780] __kmalloc_cache_noprof+0x7a/0x6f0 [ 725.385773][T14780] ? ip_set_create+0x342/0x14f0 [ 725.385811][T14780] ip_set_create+0x342/0x14f0 [ 725.385836][T14780] ? __mutex_lock+0x26a/0x1b90 [ 725.385860][T14780] ? __pfx_ip_set_create+0x10/0x10 [ 725.385895][T14780] ? find_held_lock+0x2b/0x80 [ 725.385923][T14780] nfnetlink_rcv_msg+0x9f4/0x1200 [ 725.385957][T14780] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 725.385980][T14780] ? __lock_acquire+0x4a5/0x2630 [ 725.386026][T14780] ? avc_has_perm_noaudit+0x145/0x3b0 [ 725.386058][T14780] netlink_rcv_skb+0x159/0x420 [ 725.386086][T14780] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 725.386108][T14780] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 725.386146][T14780] ? ns_capable+0xd2/0xf0 [ 725.386169][T14780] nfnetlink_rcv+0x1b3/0x440 [ 725.386188][T14780] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 725.386209][T14780] ? netlink_deliver_tap+0x1ae/0xcc0 [ 725.386239][T14780] netlink_unicast+0x5aa/0x870 [ 725.386270][T14780] ? __pfx_netlink_unicast+0x10/0x10 [ 725.386307][T14780] netlink_sendmsg+0x8b0/0xda0 [ 725.386338][T14780] ? __pfx_netlink_sendmsg+0x10/0x10 [ 725.386363][T14780] ? __might_fault+0xc0/0x140 [ 725.386394][T14780] ____sys_sendmsg+0xa54/0xc30 [ 725.386426][T14780] ? __pfx_____sys_sendmsg+0x10/0x10 [ 725.386466][T14780] ___sys_sendmsg+0x190/0x1e0 [ 725.386487][T14780] ? __pfx____sys_sendmsg+0x10/0x10 [ 725.386539][T14780] __sys_sendmsg+0x170/0x220 [ 725.386564][T14780] ? __pfx___sys_sendmsg+0x10/0x10 [ 725.386606][T14780] do_syscall_64+0x106/0xf80 [ 725.386631][T14780] ? clear_bhb_loop+0x40/0x90 [ 725.386654][T14780] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 725.386672][T14780] RIP: 0033:0x7fa03899bf79 [ 725.386688][T14780] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 725.386706][T14780] RSP: 002b:00007fa039821028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 725.386725][T14780] RAX: ffffffffffffffda RBX: 00007fa038c15fa0 RCX: 00007fa03899bf79 [ 725.386737][T14780] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 725.386748][T14780] RBP: 00007fa039821090 R08: 0000000000000000 R09: 0000000000000000 [ 725.386759][T14780] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 725.386770][T14780] R13: 00007fa038c16038 R14: 00007fa038c15fa0 R15: 00007ffe8f722358 [ 725.386796][T14780] [ 726.092129][T14787] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 726.202242][T14789] lo speed is unknown, defaulting to 1000 [ 727.611922][ T30] audit: type=1400 audit(1771332509.499:1521): avc: denied { ioctl } for pid=14805 comm="syz.4.2371" path="socket:[51334]" dev="sockfs" ino=51334 ioctlcmd=0x8922 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 728.101985][T13571] IPVS: starting estimator thread 0... [ 728.295060][T14815] IPVS: using max 49 ests per chain, 117600 per kthread [ 728.435405][ T5817] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 728.447830][ T5817] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 728.464915][ T5817] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 728.472693][ T5817] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 728.480131][ T5817] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 728.532819][T14817] lo speed is unknown, defaulting to 1000 [ 728.694120][T14820] syzkaller0: entered promiscuous mode [ 728.700920][T14820] syzkaller0: entered allmulticast mode [ 729.603232][ T30] audit: type=1800 audit(1771332511.490:1522): pid=14838 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=set_data cause=unavailable-hash-algorithm comm="syz.2.2379" name="/" dev="sockfs" ino=51421 res=0 errno=0 [ 730.574417][ T5817] Bluetooth: hci5: command tx timeout [ 731.400565][T14817] chnl_net:caif_netlink_parms(): no params data found [ 731.624425][T14861] tipc: Enabled bearer , priority 0 [ 732.034973][T14862] syzkaller0: entered promiscuous mode [ 732.072492][T14862] syzkaller0: entered allmulticast mode [ 732.080256][T14862] tipc: Resetting bearer [ 732.101907][T14873] syzkaller0: entered promiscuous mode [ 732.107503][T14873] syzkaller0: entered allmulticast mode [ 732.117605][T14817] bridge0: port 1(bridge_slave_0) entered blocking state [ 732.127930][T14817] bridge0: port 1(bridge_slave_0) entered disabled state [ 732.145095][T14817] bridge_slave_0: entered allmulticast mode [ 732.167592][T14817] bridge_slave_0: entered promiscuous mode [ 732.232172][ T106] tipc: Resetting bearer [ 732.348388][T14860] tipc: Resetting bearer [ 733.038086][ T5817] Bluetooth: hci5: command tx timeout [ 733.436888][ T5940] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 733.589817][ T5940] usb 5-1: too many configurations: 53, using maximum allowed: 8 [ 733.647987][ T5940] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 733.673668][ T5940] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 733.692369][ T5940] usb 5-1: Product: syz [ 733.696551][ T5940] usb 5-1: Manufacturer: syz [ 733.701450][ T5940] usb 5-1: SerialNumber: syz [ 735.090992][ T5817] Bluetooth: hci5: command tx timeout [ 735.264867][T14860] tipc: Disabling bearer [ 735.284127][T14817] bridge0: port 2(bridge_slave_1) entered blocking state [ 735.291431][T14817] bridge0: port 2(bridge_slave_1) entered disabled state [ 735.298853][T14817] bridge_slave_1: entered allmulticast mode [ 735.305772][T14817] bridge_slave_1: entered promiscuous mode [ 735.349539][T14817] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 735.370941][T14881] lo speed is unknown, defaulting to 1000 [ 735.379494][T14817] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 736.857386][T14817] team0: Port device team_slave_0 added [ 736.919517][T14817] team0: Port device team_slave_1 added [ 737.175092][ T5817] Bluetooth: hci5: command tx timeout [ 737.217080][T14817] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 737.273405][T14817] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 737.578613][T14817] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 737.594362][T14817] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 737.602383][T14817] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 737.777626][T14817] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 737.999388][T14914] bridge0: port 3(vlan2) entered blocking state [ 738.024655][T14914] bridge0: port 3(vlan2) entered disabled state [ 738.031256][T14914] vlan2: entered allmulticast mode [ 738.054698][T14914] bridge0: entered allmulticast mode [ 738.192475][T14917] openvswitch: netlink: Message has 1 unknown bytes. [ 738.222308][T14914] vlan2: left allmulticast mode [ 738.234486][T14917] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 738.251825][T14914] bridge0: left allmulticast mode [ 738.479873][T14817] hsr_slave_0: entered promiscuous mode [ 738.494251][T14817] hsr_slave_1: entered promiscuous mode [ 738.522496][T14817] debugfs: 'hsr0' already exists in 'hsr' [ 738.534336][T14817] Cannot create hsr debugfs directory [ 738.784261][ T5940] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -ETIMEDOUT [ 738.835454][ T5940] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -110 [ 738.875065][ T5940] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 738.914097][ T5940] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -110 [ 738.926366][ T30] audit: type=1400 audit(1771332520.805:1523): avc: denied { read } for pid=14919 comm="syz.2.2397" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 739.280339][T14817] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 739.309420][T14817] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 739.348483][T14817] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 739.397516][T14817] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 739.418200][ T5875] usb 5-1: USB disconnect, device number 82 [ 739.741068][T14817] 8021q: adding VLAN 0 to HW filter on device bond0 [ 739.811884][T14817] 8021q: adding VLAN 0 to HW filter on device team0 [ 739.832415][ T63] bridge0: port 1(bridge_slave_0) entered blocking state [ 739.839610][ T63] bridge0: port 1(bridge_slave_0) entered forwarding state [ 739.878378][ T106] bridge0: port 2(bridge_slave_1) entered blocking state [ 739.885506][ T106] bridge0: port 2(bridge_slave_1) entered forwarding state [ 739.919375][T14934] tipc: Enabling of bearer rejected, already enabled [ 740.131367][T14942] syzkaller0: entered promiscuous mode [ 740.153645][T14942] syzkaller0: entered allmulticast mode [ 740.253630][T14817] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 740.530277][ T30] audit: type=1400 audit(1771332522.416:1524): avc: denied { read append } for pid=14951 comm="syz.2.2402" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 740.583368][ T30] audit: type=1400 audit(1771332522.416:1525): avc: denied { open } for pid=14951 comm="syz.2.2402" path="/dev/ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 740.706941][T14956] netlink: 'syz.2.2402': attribute type 12 has an invalid length. [ 740.722341][T14956] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2402'. [ 740.751150][ T30] audit: type=1400 audit(1771332522.416:1526): avc: denied { ioctl } for pid=14951 comm="syz.2.2402" path="/dev/ppp" dev="devtmpfs" ino=709 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 741.309161][T14965] netlink: 'syz.4.2404': attribute type 1 has an invalid length. [ 741.393580][T14965] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 741.567522][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 741.573994][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 741.650329][T14965] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 741.911182][T14972] macvlan3: entered promiscuous mode [ 741.939170][T14972] macvlan3: entered allmulticast mode [ 741.968257][T14972] bond2: entered promiscuous mode [ 741.993412][T14972] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 742.074431][T14972] bond2: left promiscuous mode [ 742.110817][T14973] bond0: entered promiscuous mode [ 742.116205][T14973] bond_slave_0: entered promiscuous mode [ 742.121997][T14973] bond_slave_1: entered promiscuous mode [ 742.129321][T14973] batadv0: entered promiscuous mode [ 742.135217][T14973] debugfs: 'hsr1' already exists in 'hsr' [ 742.140950][T14973] Cannot create hsr debugfs directory [ 742.146922][T14973] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 742.184678][ T30] audit: type=1400 audit(1771332524.077:1527): avc: denied { setopt } for pid=14975 comm="syz.2.2406" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 742.196063][T14817] veth0_vlan: entered promiscuous mode [ 742.254348][T14817] veth1_vlan: entered promiscuous mode [ 742.301573][T14817] veth0_macvtap: entered promiscuous mode [ 742.325787][T14817] veth1_macvtap: entered promiscuous mode [ 742.359978][T14817] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 742.392890][T14817] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 742.429308][ T106] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 742.448309][ T106] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 742.472633][ T106] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 742.498602][ T106] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 742.697705][T14978] lo speed is unknown, defaulting to 1000 [ 742.726070][ T106] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 742.891034][ T106] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 743.212861][ T5890] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 743.227861][ T190] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 743.270585][ T190] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 743.297588][T14989] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2409'. [ 743.309859][T14989] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2409'. [ 743.531447][ T5890] usb 3-1: too many configurations: 53, using maximum allowed: 8 [ 743.552333][ T5890] usb 3-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 743.561584][ T5890] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 743.570446][ T5890] usb 3-1: Product: syz [ 743.584445][ T5890] usb 3-1: Manufacturer: syz [ 743.597428][ T5890] usb 3-1: SerialNumber: syz [ 743.607792][ T30] audit: type=1400 audit(1771332525.497:1528): avc: denied { getopt } for pid=14995 comm="syz.6.2410" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 743.785649][ T5940] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 743.972050][ T5940] usb 5-1: Using ep0 maxpacket: 8 [ 744.023256][ T5940] usb 5-1: too many endpoints for config 0 interface 0 altsetting 166: 128, using maximum allowed: 30 [ 744.027744][ T5890] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 744.035218][ T5940] usb 5-1: config 0 interface 0 altsetting 166 has 0 endpoint descriptors, different from the interface descriptor's value: 128 [ 744.072024][ T5890] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 744.075913][ T5940] usb 5-1: config 0 interface 0 has no altsetting 0 [ 744.083662][ T5890] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 744.139190][ T5940] usb 5-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 744.255629][ T5890] lan78xx 3-1:1.0: probe with driver lan78xx failed with error -71 [ 744.336233][ T5940] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 744.344431][ T5890] usb 3-1: USB disconnect, device number 66 [ 744.348059][ T5940] usb 5-1: Product: syz [ 744.378554][ T5940] usb 5-1: Manufacturer: syz [ 744.393086][ T5940] usb 5-1: SerialNumber: syz [ 744.406065][ T5940] usb 5-1: config 0 descriptor?? [ 744.420055][ T5940] gspca_main: se401-2.14.0 probing 047d:5003 [ 744.481175][T15006] tipc: Started in network mode [ 744.487826][T15006] tipc: Node identity 02e21c49a6c2, cluster identity 4711 [ 744.495292][T15006] tipc: Enabled bearer , priority 0 [ 744.523778][T15006] syzkaller0: entered promiscuous mode [ 744.529290][T15006] syzkaller0: entered allmulticast mode [ 744.535771][T15006] tipc: Resetting bearer [ 744.911252][ T978] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 745.084068][ T978] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 8 [ 745.096073][ T978] usb 3-1: New USB device found, idVendor=2c7c, idProduct=030e, bcdDevice=81.28 [ 745.105790][ T978] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 745.114054][ T978] usb 3-1: Product: syz [ 745.118327][ T978] usb 3-1: Manufacturer: syz [ 745.123064][ T978] usb 3-1: SerialNumber: syz [ 745.129620][ T978] usb 3-1: config 0 descriptor?? [ 745.135405][T15010] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 745.144451][ T978] option 3-1:0.0: GSM modem (1-port) converter detected [ 745.295230][T15005] tipc: Resetting bearer [ 745.665306][ T5940] gspca_se401: write req failed req 0x57 val 0x00 error -110 [ 745.673001][ T5940] se401 5-1:0.0: probe with driver se401 failed with error -110 [ 745.960870][ T5826] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 746.116278][ T5826] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 746.140253][ T5826] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 746.161819][ T5826] usb 6-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 746.179484][ T5826] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 746.206008][ T5826] usb 6-1: config 0 descriptor?? [ 746.281287][ T978] usb 5-1: USB disconnect, device number 83 [ 746.647421][T15017] netlink: 'syz.6.2416': attribute type 1 has an invalid length. [ 746.682851][ T2767] block nbd0: Possible stuck request ffff888027d70000: control (read@0,4096B). Runtime 240 seconds [ 746.689111][ T5826] hid-steam 0003:28DE:1142.001C: : USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.5-1/input0 [ 746.790224][ T5826] hid-steam 0003:28DE:1142.001C: Steam wireless receiver connected [ 746.912833][ T5826] hid-steam 0003:28DE:1142.001D: hidraw0: USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.5-1/input0 [ 746.994947][ T5826] usb 6-1: USB disconnect, device number 43 [ 747.023936][T15022] fido_id[15022]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:28DE:1142.001D/report_descriptor': No such device [ 747.082051][ T5826] hid-steam 0003:28DE:1142.001C: Steam wireless receiver disconnected [ 747.698359][T15024] openvswitch: netlink: Message has 1 unknown bytes. [ 747.713777][T15024] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 747.730124][ T5826] usb 3-1: USB disconnect, device number 67 [ 747.767919][ T5826] option 3-1:0.0: device disconnected [ 747.965411][T15005] tipc: Disabling bearer [ 747.979361][ T5875] tipc: Node number set to 2753567817 [ 748.124224][T15018] bond4: (slave vxcan3): The slave device specified does not support setting the MAC address [ 748.142632][T15018] bond4: (slave vxcan3): Error -95 calling set_mac_address [ 748.838125][T15019] macvlan2: entered promiscuous mode [ 748.846341][T15019] macvlan2: entered allmulticast mode [ 748.852527][T15019] bond4: entered promiscuous mode [ 748.858153][T15019] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 748.872719][T15038] netlink: 28 bytes leftover after parsing attributes in process `syz.7.2420'. [ 748.894249][T15019] bond4: left promiscuous mode [ 748.903532][T15038] team0: entered promiscuous mode [ 748.910307][T15038] team_slave_0: entered promiscuous mode [ 748.917849][T15038] team_slave_1: entered promiscuous mode [ 748.949556][T15038] team0: entered allmulticast mode [ 748.989196][T15038] team_slave_0: entered allmulticast mode [ 748.995681][T15038] team_slave_1: entered allmulticast mode [ 749.012169][T15037] dummy0: entered promiscuous mode [ 749.019205][T15037] dummy0: entered allmulticast mode [ 749.027069][T15037] team0: Port device dummy0 added [ 749.825190][ T30] audit: type=1400 audit(1771332531.721:1529): avc: denied { ioctl } for pid=15048 comm="syz.6.2424" path="/109/file0/file0" dev="fuse" ino=64 ioctlcmd=0x4d02 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 750.056286][T15060] rdma_rxe: rxe_newlink: failed to add syz_tun [ 750.165074][ T5875] usb 8-1: new low-speed USB device number 2 using dummy_hcd [ 750.358766][ T9] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 750.378470][ T5875] usb 8-1: Invalid ep0 maxpacket: 64 [ 750.588558][ T5875] usb 8-1: new low-speed USB device number 3 using dummy_hcd [ 750.652902][ T9] usb 5-1: unable to get BOS descriptor or descriptor too short [ 750.669411][ T9] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 750.679483][ T9] usb 5-1: can't read configurations, error -71 [ 750.759833][ T5875] usb 8-1: Invalid ep0 maxpacket: 64 [ 750.779224][ T5875] usb usb8-port1: attempt power cycle [ 751.128037][ T5875] usb 8-1: new low-speed USB device number 4 using dummy_hcd [ 751.166826][ T5875] usb 8-1: Invalid ep0 maxpacket: 64 [ 751.207509][T15068] tipc: Started in network mode [ 751.213064][T15068] tipc: Node identity 5a26bda8adc8, cluster identity 4711 [ 751.262376][T15068] tipc: Enabled bearer , priority 0 [ 751.320989][ T5875] usb 8-1: new low-speed USB device number 5 using dummy_hcd [ 751.368494][ T5875] usb 8-1: Invalid ep0 maxpacket: 64 [ 751.383576][ T5875] usb usb8-port1: unable to enumerate USB device [ 751.397194][T15071] syzkaller0: entered promiscuous mode [ 751.418312][T15071] syzkaller0: entered allmulticast mode [ 751.425993][T15071] tipc: Resetting bearer [ 751.660968][T15085] tmpfs: Unknown parameter 'grpquota_block_hardlim)t' [ 752.062345][T15067] tipc: Resetting bearer [ 753.172631][ T978] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 753.338684][ T978] usb 8-1: Using ep0 maxpacket: 8 [ 753.358109][ T978] usb 8-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x41, changing to 0x1 [ 753.370473][ T978] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 753.381978][ T978] usb 8-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=77.1e [ 753.391368][ T978] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 753.399693][ T978] usb 8-1: Product: syz [ 753.403864][ T978] usb 8-1: Manufacturer: syz [ 753.409592][ T978] usb 8-1: SerialNumber: syz [ 753.417050][ T978] usb 8-1: config 0 descriptor?? [ 754.235401][ T978] streamzap 8-1:0.0: streamzap_probe: endpoint doesn't match input device 0201 [ 754.254913][ T978] usb 8-1: USB disconnect, device number 6 [ 754.859694][T15067] tipc: Disabling bearer [ 754.868606][ T5868] tipc: Node number set to 4159618472 [ 755.070846][T15105] netlink: 'syz.6.2439': attribute type 1 has an invalid length. [ 755.108078][T15105] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 755.206415][T15105] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 755.238806][T15111] ªªªªªª: renamed from vlan0 (while UP) [ 755.527596][ T5826] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 755.711640][ T5826] usb 5-1: unable to get BOS descriptor or descriptor too short [ 755.733377][T15121] openvswitch: netlink: Message has 1 unknown bytes. [ 755.738073][ T5826] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 755.752068][ T5826] usb 5-1: can't read configurations, error -71 [ 755.757016][T15121] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 755.861564][T15125] netlink: 'syz.5.2446': attribute type 1 has an invalid length. [ 756.020622][T15125] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 756.097668][T15125] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 756.469371][T15134] macvlan2: entered promiscuous mode [ 756.498361][T15134] macvlan2: entered allmulticast mode [ 756.504394][T15134] bond2: entered promiscuous mode [ 756.560196][T15134] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 757.288089][T15134] bond2: left promiscuous mode [ 757.403811][T15144] tipc: Enabled bearer , priority 0 [ 757.881328][T15140] tipc: Disabling bearer [ 757.906429][ T30] audit: type=1400 audit(1771332539.464:1530): avc: denied { mount } for pid=15148 comm="syz.4.2450" name="/" dev="configfs" ino=1191 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 757.966136][T15123] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=15123 comm=syz.6.2445 [ 757.990414][ T30] audit: type=1400 audit(1771332539.464:1531): avc: denied { search } for pid=15148 comm="syz.4.2450" name="/" dev="configfs" ino=1191 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 758.082931][ T30] audit: type=1400 audit(1771332539.464:1532): avc: denied { search } for pid=15148 comm="syz.4.2450" name="/" dev="configfs" ino=1191 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 758.142087][ T30] audit: type=1400 audit(1771332539.464:1533): avc: denied { read open } for pid=15148 comm="syz.4.2450" path="/" dev="configfs" ino=1191 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 758.146040][T15156] syzkaller0: entered promiscuous mode [ 758.204639][ T30] audit: type=1400 audit(1771332539.474:1534): avc: denied { search } for pid=15148 comm="syz.4.2450" name="/" dev="configfs" ino=1191 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 758.284396][ T30] audit: type=1400 audit(1771332539.474:1535): avc: denied { search } for pid=15148 comm="syz.4.2450" name="/" dev="configfs" ino=1191 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 758.325712][T15156] syzkaller0: entered allmulticast mode [ 758.351867][ T5817] Bluetooth: hci3: unexpected event 0x2f length: 509 > 260 [ 758.352860][ T30] audit: type=1400 audit(1771332539.474:1536): avc: denied { search } for pid=15148 comm="syz.4.2450" name="/" dev="configfs" ino=1191 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 758.896604][T15157] netdevsim netdevsim5: loading /lib/firmware/. failed with error -22 [ 758.905304][T15157] netdevsim netdevsim5: Direct firmware load for . failed with error -22 [ 758.916174][ T30] audit: type=1400 audit(1771332540.815:1537): avc: denied { firmware_load } for pid=15153 comm="syz.5.2452" scontext=system_u:system_r:kernel_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 758.916293][T15157] netdevsim netdevsim5: Falling back to sysfs fallback for: . [ 760.339983][T15185] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2460'. [ 760.473512][ T5890] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 760.630834][ T5890] usb 6-1: unable to get BOS descriptor or descriptor too short [ 760.647202][ T5890] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 760.664104][ T5890] usb 6-1: can't read configurations, error -71 [ 760.814534][T15187] tipc: Enabling of bearer rejected, already enabled [ 762.978588][T15217] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2468'. [ 763.208453][ T5875] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 763.423563][ T5875] usb 5-1: Using ep0 maxpacket: 8 [ 763.489035][ T5875] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 763.497692][ T5875] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 763.703496][ T5875] usb 5-1: config 0 has no interface number 0 [ 763.720643][ T5875] usb 5-1: config 0 interface 55 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 763.745847][ T5875] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 763.763009][ T5875] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 763.811378][ T5875] usb 5-1: config 0 descriptor?? [ 763.837601][ T5875] ldusb 5-1:0.55: Interrupt in endpoint not found [ 763.862967][T15229] trusted_key: encrypted_key: insufficient parameters specified [ 763.963918][ T5826] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 764.149301][ T5817] Bluetooth: hci3: unexpected event 0x2f length: 509 > 260 [ 764.183618][ T5875] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 764.256531][T15231] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2475'. [ 764.275070][ T5826] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 764.293666][ T5826] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 764.314089][ T5826] usb 3-1: config 0 descriptor?? [ 764.373496][ T5875] usb 8-1: Using ep0 maxpacket: 32 [ 764.379879][ T5875] usb 8-1: config 0 has an invalid interface number: 35 but max is 0 [ 764.390122][ T5875] usb 8-1: config 0 has no interface number 0 [ 764.396460][ T5875] usb 8-1: config 0 interface 35 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 764.398600][ T9] usb 5-1: USB disconnect, device number 88 [ 764.407873][ T5875] usb 8-1: config 0 interface 35 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 764.472989][ T5875] usb 8-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 764.489109][ T5875] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 764.499945][ T5875] usb 8-1: Product: syz [ 764.504532][ T5875] usb 8-1: Manufacturer: syz [ 764.509361][ T5875] usb 8-1: SerialNumber: syz [ 764.525494][ T5875] usb 8-1: config 0 descriptor?? [ 764.753500][ T978] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 764.791456][T15228] batadv_slave_1: entered promiscuous mode [ 764.801362][T15228] batadv_slave_1: entered allmulticast mode [ 765.059870][ T978] usb 6-1: unable to get BOS descriptor or descriptor too short [ 765.067771][ T5875] radio-si470x 8-1:0.35: DeviceID=0x9242 ChipID=0x0000 [ 765.075732][ T5875] radio-si470x 8-1:0.35: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 765.088854][ T978] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 765.096706][ T978] usb 6-1: can't read configurations, error -71 [ 765.560783][ T5826] ath6kl: Failed to submit usb control message: -110 [ 765.570252][ T5826] ath6kl: unable to send the bmi data to the device: -110 [ 765.571855][ T5875] radio-si470x 8-1:0.35: software version 146, hardware version 66 [ 765.583454][ T5826] ath6kl: Unable to send get target info: -110 [ 765.598997][ T5826] ath6kl: Failed to init ath6kl core: -110 [ 765.613724][ T5875] radio-si470x 8-1:0.35: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 765.627682][ T5826] ath6kl_usb 3-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 766.055569][T15228] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2474'. [ 766.089428][T15228] netlink: 20 bytes leftover after parsing attributes in process `syz.7.2474'. [ 766.163646][ T5875] radio-si470x 8-1:0.35: si470x_set_report: usb_control_msg returned -110 [ 766.228514][T15250] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2479'. [ 766.253750][ T5875] radio-si470x 8-1:0.35: submitting int urb failed (-90) [ 766.327182][ T978] usb 3-1: USB disconnect, device number 68 [ 766.363590][ T5875] radio-si470x 8-1:0.35: si470x_set_report: usb_control_msg returned -32 [ 766.402367][ T5875] radio-si470x 8-1:0.35: probe with driver radio-si470x failed with error -22 [ 766.446440][ T5875] radio-raremono 8-1:0.35: this is not Thanko's Raremono. [ 766.460219][ T5875] usb 8-1: USB disconnect, device number 7 [ 766.682064][T15256] orangefs_mount: mount request failed with -4 [ 766.782035][T15280] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2483'. [ 767.823521][ T9] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 767.890024][T15304] netlink: 'syz.5.2490': attribute type 1 has an invalid length. [ 767.944884][T15304] bond3: (slave vxcan3): The slave device specified does not support setting the MAC address [ 767.967856][T15304] bond3: (slave vxcan3): Error -95 calling set_mac_address [ 768.003559][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 768.022897][ T9] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 768.032414][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 768.063361][ T9] usb 3-1: config 0 has no interface number 0 [ 768.185119][ T5890] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 768.224057][ T9] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 768.251112][ T9] usb 3-1: config 0 interface 55 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 768.268296][ T9] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 768.278398][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 768.292845][ T9] usb 3-1: config 0 descriptor?? [ 768.306347][ T9] ldusb 3-1:0.55: Interrupt in endpoint not found [ 768.318177][T15304] macvlan2: entered promiscuous mode [ 768.341668][T15304] macvlan2: entered allmulticast mode [ 768.394135][T15304] bond3: entered promiscuous mode [ 768.416606][T15304] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 768.447281][T15304] bond3: left promiscuous mode [ 768.467091][ T5890] usb 8-1: unable to get BOS descriptor or descriptor too short [ 768.476884][ T5890] usb 8-1: unable to read config index 0 descriptor/start: -71 [ 768.487031][ T5890] usb 8-1: can't read configurations, error -71 [ 770.146624][ T978] usb 3-1: USB disconnect, device number 69 [ 772.474387][ T5890] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 772.773224][ T5890] usb 6-1: unable to get BOS descriptor or descriptor too short [ 772.782085][ T5890] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 772.799744][ T5890] usb 6-1: can't read configurations, error -71 [ 772.850017][T15375] lo speed is unknown, defaulting to 1000 [ 773.156298][ T978] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 773.433598][ T978] usb 3-1: too many configurations: 53, using maximum allowed: 8 [ 773.473465][T15381] nbd: must specify a device to reconfigure [ 773.501212][ T978] usb 3-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 773.510659][ T978] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 773.519248][ T978] usb 3-1: Product: syz [ 773.523747][ T978] usb 3-1: Manufacturer: syz [ 773.528420][ T978] usb 3-1: SerialNumber: syz [ 774.294942][ T978] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 774.306903][ T978] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 774.317601][ T978] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 774.338306][ T978] lan78xx 3-1:1.0: probe with driver lan78xx failed with error -71 [ 774.382478][ T978] usb 3-1: USB disconnect, device number 70 [ 775.516684][ T5890] usb 6-1: new high-speed USB device number 50 using dummy_hcd [ 775.733633][ T5890] usb 6-1: Using ep0 maxpacket: 16 [ 775.773785][ T5890] usb 6-1: config 157 has an invalid descriptor of length 0, skipping remainder of the config [ 775.861136][ T5890] usb 6-1: config 157 has 0 interfaces, different from the descriptor's value: 1 [ 775.904799][ T5890] usb 6-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 775.916182][ T5890] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 775.932561][ T5890] usb 6-1: Product: syz [ 776.019186][ T5890] usb 6-1: Manufacturer: syz [ 776.032222][ T5890] usb 6-1: SerialNumber: syz [ 776.103503][ T5875] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 776.277804][ T5875] usb 3-1: device descriptor read/64, error -71 [ 776.573534][ T5875] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 776.713879][ T5875] usb 3-1: device descriptor read/64, error -71 [ 776.784242][ T2767] block nbd0: Possible stuck request ffff888027d70000: control (read@0,4096B). Runtime 270 seconds [ 776.836007][ T5875] usb usb3-port1: attempt power cycle [ 777.193933][ T5875] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 777.309318][ T5875] usb 3-1: device descriptor read/8, error -71 [ 777.553743][ T5875] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 777.594696][ T5875] usb 3-1: device descriptor read/8, error -71 [ 777.741011][ T5875] usb usb3-port1: unable to enumerate USB device [ 778.216585][ T5890] usb 6-1: USB disconnect, device number 50 [ 778.715589][T15445] FAT-fs (loop11): unable to read boot sector [ 779.014322][ T30] audit: type=1400 audit(1771332560.606:1538): avc: denied { create } for pid=15443 comm="syz.5.2526" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 779.269614][ T30] audit: type=1400 audit(1771332560.606:1539): avc: denied { mounton } for pid=15443 comm="syz.5.2526" path="/253/file0" dev="tmpfs" ino=1407 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 779.393651][ T30] audit: type=1400 audit(1771332561.086:1540): avc: denied { unlink } for pid=10294 comm="syz-executor" name="file0" dev="tmpfs" ino=1407 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 779.713518][ T978] usb 8-1: new full-speed USB device number 10 using dummy_hcd [ 779.958545][ T978] usb 8-1: config 0 has an invalid interface number: 2 but max is 0 [ 780.051904][ T978] usb 8-1: config 0 has no interface number 0 [ 780.282098][ T978] usb 8-1: config 0 interface 2 altsetting 2 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 780.513721][ T978] usb 8-1: config 0 interface 2 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 780.612378][ T978] usb 8-1: config 0 interface 2 altsetting 2 endpoint 0x82 has invalid maxpacket 192, setting to 64 [ 780.623986][ T978] usb 8-1: config 0 interface 2 has no altsetting 0 [ 780.641976][ T978] usb 8-1: New USB device found, idVendor=086a, idProduct=0003, bcdDevice=f0.3f [ 780.651296][ T978] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 780.659387][ T978] usb 8-1: Product: syz [ 780.664288][ T978] usb 8-1: Manufacturer: syz [ 780.673544][ T978] usb 8-1: SerialNumber: syz [ 781.083667][ T978] usb 8-1: config 0 descriptor?? [ 781.091906][T15452] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 781.099558][T15452] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 781.977927][ T978] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 782.041135][T15477] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2536'. [ 782.100891][T15478] lo speed is unknown, defaulting to 1000 [ 782.282609][ T978] usb 8-1: USB disconnect, device number 10 [ 782.850442][T15485] ./file0: Can't lookup blockdev [ 783.526251][T15492] netlink: 'syz.6.2542': attribute type 1 has an invalid length. [ 783.799021][T15499] bond6: (slave vxcan3): The slave device specified does not support setting the MAC address [ 783.911169][T15499] bond6: (slave vxcan3): Error -95 calling set_mac_address [ 785.146595][T15512] wireguard0: entered promiscuous mode [ 785.152079][T15512] wireguard0: entered allmulticast mode [ 785.344324][ T5826] usb 8-1: new full-speed USB device number 11 using dummy_hcd [ 785.363475][ T5940] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 785.533608][ T5940] usb 5-1: Using ep0 maxpacket: 16 [ 785.539666][ T30] audit: type=1400 audit(1771332567.436:1541): avc: denied { bind } for pid=15518 comm="syz.6.2547" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 785.700508][ T5826] usb 8-1: config 0 has an invalid interface number: 41 but max is 0 [ 785.700931][ T5940] usb 5-1: config 0 has an invalid interface number: 121 but max is 0 [ 785.733462][ T5826] usb 8-1: config 0 has no interface number 0 [ 785.742364][ T5826] usb 8-1: config 0 interface 41 has no altsetting 0 [ 785.743499][ T5940] usb 5-1: config 0 has no interface number 0 [ 785.773735][ T5826] usb 8-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 785.785489][ T5940] usb 5-1: too many endpoints for config 0 interface 121 altsetting 110: 87, using maximum allowed: 30 [ 785.796970][ T5940] usb 5-1: config 0 interface 121 altsetting 110 has 0 endpoint descriptors, different from the interface descriptor's value: 87 [ 785.810731][ T5940] usb 5-1: config 0 interface 121 has no altsetting 0 [ 785.819574][ T5940] usb 5-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 785.845075][ T5940] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 785.855188][ T5940] usb 5-1: Product: syz [ 785.859370][ T5940] usb 5-1: Manufacturer: syz [ 785.866139][ T5940] usb 5-1: SerialNumber: syz [ 785.873018][ T5940] usb 5-1: config 0 descriptor?? [ 785.909632][ T5826] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 785.931022][ T5826] usb 8-1: Product: syz [ 785.935317][ T5826] usb 8-1: Manufacturer: syz [ 785.940077][ T5826] usb 8-1: SerialNumber: syz [ 785.957161][ T5826] usb 8-1: config 0 descriptor?? [ 786.152080][ T5940] usb 5-1: USB disconnect, device number 89 [ 786.784664][T15534] FAT-fs (loop11): unable to read boot sector [ 787.505053][ T30] audit: type=1400 audit(1771332569.406:1542): avc: denied { read } for pid=15536 comm="syz.2.2553" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 787.688826][ T5817] Bluetooth: hci4: unexpected event for opcode 0x1002 [ 787.733128][ T5826] CoreChips 8-1:0.41: probe with driver CoreChips failed with error -71 [ 787.931333][ T5826] usb 8-1: USB disconnect, device number 11 [ 788.180690][T15540] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 788.187429][T15540] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 788.195810][T15540] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 788.212613][T15540] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 788.246286][T15540] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 788.253061][T15540] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 788.259661][T15540] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 788.266929][T15540] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 788.273115][T15540] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 788.359017][T15561] netlink: 'syz.7.2557': attribute type 1 has an invalid length. [ 788.474473][T15540] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 788.733466][ T5868] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 788.768421][T15561] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 788.781142][T15561] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 788.870423][T15565] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2559'. [ 788.933531][ T5868] usb 6-1: Using ep0 maxpacket: 16 [ 788.955793][ T5868] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 788.975576][ T5868] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 788.993541][ T5868] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 789.013500][ T5868] usb 6-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 789.040802][T15563] macvlan2: entered promiscuous mode [ 789.046213][ T5868] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 789.068220][T15563] macvlan2: entered allmulticast mode [ 789.074344][ T5868] usb 6-1: config 0 descriptor?? [ 789.159967][T15563] bond1: entered promiscuous mode [ 789.191132][T15563] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 789.224057][T15563] bond1: left promiscuous mode [ 789.577431][ T30] audit: type=1400 audit(1771332571.476:1543): avc: denied { add_name } for pid=15576 comm="syz.2.2562" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:" [ 789.653546][ T5817] Bluetooth: hci0: command 0x0406 tx timeout [ 789.682235][ T5868] shield 0003:0955:7214.001E: unknown main item tag 0x0 [ 789.693664][ T5868] shield 0003:0955:7214.001E: unknown main item tag 0x0 [ 789.700860][ T5868] shield 0003:0955:7214.001E: unknown main item tag 0x0 [ 789.708162][ T30] audit: type=1400 audit(1771332571.596:1544): avc: denied { create } for pid=15576 comm="syz.2.2562" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 789.729179][ T5868] shield 0003:0955:7214.001E: unknown main item tag 0x0 [ 789.736388][ T5868] shield 0003:0955:7214.001E: unknown main item tag 0x0 [ 789.773822][ T30] audit: type=1400 audit(1771332571.596:1545): avc: denied { associate } for pid=15576 comm="syz.2.2562" name="file1" scontext=root:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 789.799138][ T5868] input: HID 0955:7214 Haptics as /devices/virtual/input/input50 [ 789.977895][ T30] audit: type=1400 audit(1771332571.616:1546): avc: denied { watch watch_reads } for pid=15576 comm="syz.2.2562" path="/541" dev="tmpfs" ino=3067 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:" [ 790.023321][ T5868] shield 0003:0955:7214.001E: Registered Thunderstrike controller [ 790.035401][ T5868] shield 0003:0955:7214.001E: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.5-1/input0 [ 790.046739][ T30] audit: type=1400 audit(1771332571.836:1547): avc: denied { rmdir } for pid=5810 comm="syz-executor" name="file1" dev="tmpfs" ino=3073 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 790.223687][ T5817] Bluetooth: hci2: command 0x0406 tx timeout [ 790.276838][ T5817] Bluetooth: hci5: command 0x0c1a tx timeout [ 790.282944][T11789] Bluetooth: hci4: command 0x0406 tx timeout [ 790.289533][T11789] Bluetooth: hci1: command 0x0406 tx timeout [ 790.296472][ T5807] Bluetooth: hci3: command 0x0406 tx timeout [ 790.314686][T15583] lo speed is unknown, defaulting to 1000 [ 790.653585][ T5868] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 790.957415][ T5868] usb 3-1: too many configurations: 53, using maximum allowed: 8 [ 791.555541][ T5875] shield 0003:0955:7214.001E: Failed to output Thunderstrike HOSTCMD request HID report due to -ESHUTDOWN [ 791.594292][ T5875] shield 0003:0955:7214.001E: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 791.626837][ T5875] shield 0003:0955:7214.001E: Failed to output Thunderstrike HOSTCMD request HID report due to -EPIPE [ 791.641215][ T5868] usb 3-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 791.652033][ T5875] shield 0003:0955:7214.001E: Failed to output Thunderstrike HOSTCMD request HID report due to -EPIPE [ 791.671533][ T5868] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 791.684342][ T5940] usb 6-1: reset high-speed USB device number 51 using dummy_hcd [ 791.724113][ T5868] usb 3-1: Product: syz [ 791.728642][ T5868] usb 3-1: Manufacturer: syz [ 791.733317][ T5868] usb 3-1: SerialNumber: syz [ 791.860094][ T5940] usb 6-1: device descriptor read/64, error -32 [ 792.378215][T15589] Bluetooth: hci1: command 0x0406 tx timeout [ 792.378532][T15588] Bluetooth: hci5: command 0x0c1a tx timeout [ 792.384323][T11789] Bluetooth: hci4: command 0x0406 tx timeout [ 793.350867][ T978] usb 6-1: USB disconnect, device number 51 [ 793.599360][T15614] netlink: 'syz.6.2571': attribute type 1 has an invalid length. [ 794.433770][T11789] Bluetooth: hci5: command 0x0c1a tx timeout [ 794.923317][T15617] bond7: (slave vxcan3): The slave device specified does not support setting the MAC address [ 795.025876][T15617] bond7: (slave vxcan3): Error -95 calling set_mac_address [ 795.197250][T15614] macvlan2: entered promiscuous mode [ 795.215052][T15614] macvlan2: entered allmulticast mode [ 795.239040][T15614] bond7: entered promiscuous mode [ 795.277227][T15614] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 795.337351][T15614] bond7: left promiscuous mode [ 795.359344][T15638] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2577'. [ 795.394803][T15635] bond0: entered promiscuous mode [ 795.399860][T15635] bond_slave_0: entered promiscuous mode [ 795.405698][T15635] bond_slave_1: entered promiscuous mode [ 795.412551][T15635] batadv0: entered promiscuous mode [ 795.419030][T15635] batadv0: left promiscuous mode [ 795.425153][T15635] bond0: left promiscuous mode [ 795.429929][T15635] bond_slave_0: left promiscuous mode [ 795.435875][T15635] bond_slave_1: left promiscuous mode [ 796.495082][ T5868] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 796.507548][ T5868] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 796.518940][ T5868] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 796.537533][ T5868] lan78xx 3-1:1.0: probe with driver lan78xx failed with error -71 [ 796.638378][ T5868] usb 3-1: USB disconnect, device number 75 [ 797.537054][T15660] ./file0: Can't lookup blockdev [ 797.744870][T15662] 8021q: VLANs not supported on ip6gre0 [ 797.765041][T15658] trusted_key: encrypted_key: insufficient parameters specified [ 797.915562][T15649] netlink: 10 bytes leftover after parsing attributes in process `syz.4.2582'. [ 799.115698][T15692] lo speed is unknown, defaulting to 1000 [ 799.133805][T15697] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2592'. [ 799.356960][ T5940] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 799.605997][ T5940] usb 8-1: too many configurations: 53, using maximum allowed: 8 [ 799.706545][ T5940] usb 8-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 800.001803][ T5940] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 800.270398][ T5940] usb 8-1: Product: syz [ 800.275017][ T5940] usb 8-1: Manufacturer: syz [ 800.279626][ T5940] usb 8-1: SerialNumber: syz [ 800.526664][ T978] IPVS: starting estimator thread 0... [ 800.613533][T15710] IPVS: using max 76 ests per chain, 182400 per kthread [ 800.697738][ T5940] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 800.711131][ T5940] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 800.723830][ T5940] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 800.798104][T15717] trusted_key: encrypted_key: insufficient parameters specified [ 801.036738][ T5940] lan78xx 8-1:1.0: probe with driver lan78xx failed with error -71 [ 801.326523][ T5940] usb 8-1: USB disconnect, device number 12 [ 801.433481][ T978] usb 6-1: new high-speed USB device number 52 using dummy_hcd [ 801.535315][T15724] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2597'. [ 801.637210][T15731] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2597'. [ 801.648133][ T978] usb 6-1: config 0 has no interfaces? [ 801.687472][ T978] usb 6-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 801.737577][ T978] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 801.770267][ T978] usb 6-1: config 0 descriptor?? [ 802.136459][ T978] usb 6-1: USB disconnect, device number 52 [ 802.676787][T15745] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2604'. [ 803.004289][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 803.024280][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 803.170911][ T30] audit: type=1326 audit(1771332585.066:1548): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15749 comm="syz.4.2603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1dfbd9bf79 code=0x7ffc0000 [ 803.893233][ T30] audit: type=1326 audit(1771332585.066:1549): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15749 comm="syz.4.2603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1dfbd9bf79 code=0x7ffc0000 [ 804.097519][T15760] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2603'. [ 804.122002][T15758] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2603'. [ 804.274475][ T30] audit: type=1326 audit(1771332585.096:1550): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15749 comm="syz.4.2603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f1dfbd9d807 code=0x7ffc0000 [ 804.322985][ T30] audit: type=1326 audit(1771332585.096:1551): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15749 comm="syz.4.2603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7f1dfbd5c84e code=0x7ffc0000 [ 804.390294][ T30] audit: type=1326 audit(1771332585.096:1552): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15749 comm="syz.4.2603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f1dfbd5c84e code=0x7ffc0000 [ 804.522901][ T30] audit: type=1326 audit(1771332585.096:1553): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15749 comm="syz.4.2603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f1dfbd5c84e code=0x7ffc0000 [ 804.684478][ T30] audit: type=1326 audit(1771332585.096:1554): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15749 comm="syz.4.2603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7f1dfbd5c84e code=0x7ffc0000 [ 804.748715][ T30] audit: type=1326 audit(1771332585.096:1555): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15749 comm="syz.4.2603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1dfbd9bf79 code=0x7ffc0000 [ 804.843535][ T30] audit: type=1326 audit(1771332585.096:1556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15749 comm="syz.4.2603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1dfbd9bf79 code=0x7ffc0000 [ 804.938025][ T30] audit: type=1326 audit(1771332585.106:1557): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15749 comm="syz.4.2603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f1dfbd5c84e code=0x7ffc0000 [ 806.255946][T15790] fuse: Bad value for 'fd' [ 807.481167][ T2767] block nbd0: Possible stuck request ffff888027d70000: control (read@0,4096B). Runtime 300 seconds [ 807.798973][T15822] netlink: 'syz.7.2623': attribute type 1 has an invalid length. [ 807.887155][T15822] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 807.947586][T15822] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 808.087232][T15826] bond2: (slave gretap1): making interface the new active one [ 808.134555][T15826] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 808.183573][T15827] macvlan2: entered promiscuous mode [ 808.230565][T15827] macvlan2: entered allmulticast mode [ 808.264113][T15827] bond2: entered promiscuous mode [ 808.325798][T15827] gretap1: entered promiscuous mode [ 808.344389][T15827] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 808.436414][T15827] bond2: (slave macvlan2): the slave hw address is in use by the bond; giving it the hw address of gretap1 [ 808.507203][T15827] bond2: left promiscuous mode [ 808.512018][T15827] gretap1: left promiscuous mode [ 808.604949][T15842] usb usb8: usbfs: process 15842 (syz.2.2624) did not claim interface 0 before use [ 809.097564][T15843] FAT-fs (loop11): unable to read boot sector [ 811.818500][T15873] trusted_key: encrypted_key: insufficient parameters specified [ 812.517061][T15879] netlink: 'syz.7.2638': attribute type 1 has an invalid length. [ 812.622081][T15879] bond3: (slave vxcan3): The slave device specified does not support setting the MAC address [ 812.762329][T15879] bond3: (slave vxcan3): Error -95 calling set_mac_address [ 814.101633][ T30] kauditd_printk_skb: 35 callbacks suppressed [ 814.101649][ T30] audit: type=1400 audit(1771332595.996:1593): avc: denied { write } for pid=15894 comm="syz.6.2645" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 814.621746][T15904] FAULT_INJECTION: forcing a failure. [ 814.621746][T15904] name failslab, interval 1, probability 0, space 0, times 0 [ 814.893763][T15904] CPU: 0 UID: 0 PID: 15904 Comm: syz.6.2647 Tainted: G L syzkaller #0 PREEMPT(full) [ 814.893795][T15904] Tainted: [L]=SOFTLOCKUP [ 814.893803][T15904] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 814.893814][T15904] Call Trace: [ 814.893823][T15904] [ 814.893832][T15904] dump_stack_lvl+0x100/0x190 [ 814.893865][T15904] should_fail_ex.cold+0x5/0xa [ 814.893893][T15904] should_failslab+0xc2/0x120 [ 814.893919][T15904] kmem_cache_alloc_node_noprof+0x81/0x6f0 [ 814.893943][T15904] ? __alloc_skb+0x140/0x710 [ 814.893970][T15904] __alloc_skb+0x140/0x710 [ 814.893991][T15904] ? __alloc_skb+0x5b7/0x710 [ 814.894011][T15904] ? __pfx___alloc_skb+0x10/0x10 [ 814.894040][T15904] netlink_alloc_large_skb+0x69/0x150 [ 814.894069][T15904] netlink_sendmsg+0x680/0xda0 [ 814.894104][T15904] ? __pfx_netlink_sendmsg+0x10/0x10 [ 814.894129][T15904] ? __might_fault+0xc0/0x140 [ 814.894158][T15904] ____sys_sendmsg+0xa54/0xc30 [ 814.894189][T15904] ? __pfx_____sys_sendmsg+0x10/0x10 [ 814.894229][T15904] ___sys_sendmsg+0x190/0x1e0 [ 814.894249][T15904] ? __pfx____sys_sendmsg+0x10/0x10 [ 814.894298][T15904] __sys_sendmsg+0x170/0x220 [ 814.894323][T15904] ? __pfx___sys_sendmsg+0x10/0x10 [ 814.894361][T15904] do_syscall_64+0x106/0xf80 [ 814.894386][T15904] ? clear_bhb_loop+0x40/0x90 [ 814.894410][T15904] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 814.894428][T15904] RIP: 0033:0x7fa03899bf79 [ 814.894444][T15904] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 814.894461][T15904] RSP: 002b:00007fa039821028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 814.894480][T15904] RAX: ffffffffffffffda RBX: 00007fa038c15fa0 RCX: 00007fa03899bf79 [ 814.894491][T15904] RDX: 0000000000008000 RSI: 0000200000000100 RDI: 0000000000000004 [ 814.894502][T15904] RBP: 00007fa039821090 R08: 0000000000000000 R09: 0000000000000000 [ 814.894513][T15904] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 814.894524][T15904] R13: 00007fa038c16038 R14: 00007fa038c15fa0 R15: 00007ffe8f722358 [ 814.894549][T15904] [ 815.378699][T15908] trusted_key: encrypted_key: insufficient parameters specified [ 816.590495][ T30] audit: type=1400 audit(1771332598.486:1594): avc: denied { read } for pid=15928 comm="syz.7.2655" path="socket:[58151]" dev="sockfs" ino=58151 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 816.674240][ T5890] libceph: connect (1)[c::]:6789 error -101 [ 816.680594][ T5890] libceph: mon0 (1)[c::]:6789 connect error [ 816.762672][T15935] netlink: 164 bytes leftover after parsing attributes in process `syz.7.2655'. [ 816.763993][ T30] audit: type=1400 audit(1771332598.656:1595): avc: denied { nlmsg_read } for pid=15928 comm="syz.7.2655" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 816.944719][ T5890] libceph: connect (1)[c::]:6789 error -101 [ 816.950816][ T5890] libceph: mon0 (1)[c::]:6789 connect error [ 817.029160][T15948] netlink: 'syz.6.2658': attribute type 1 has an invalid length. [ 817.163918][T15952] bond8: (slave vxcan3): The slave device specified does not support setting the MAC address [ 817.416920][T15952] bond8: (slave vxcan3): Error -95 calling set_mac_address [ 817.496184][ T5890] libceph: connect (1)[c::]:6789 error -101 [ 817.502536][ T5890] libceph: mon0 (1)[c::]:6789 connect error [ 817.743456][ T30] audit: type=1400 audit(1771332599.636:1596): avc: denied { bind } for pid=15957 comm="syz.2.2660" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 817.913108][T15959] binder: BINDER_SET_CONTEXT_MGR already set [ 817.919677][T15959] binder: 15943:15959 ioctl 4018620d 2000000000c0 returned -16 [ 818.422084][ T30] audit: type=1400 audit(1771332600.316:1597): avc: denied { ioctl } for pid=15968 comm="syz.6.2662" path="socket:[58200]" dev="sockfs" ino=58200 ioctlcmd=0x8925 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 819.079231][T15972] ./file0: Can't lookup blockdev [ 819.254636][T15930] ceph: No mds server is up or the cluster is laggy [ 819.663694][ T5861] libceph: connect (1)[c::]:6789 error -101 [ 819.669788][ T5861] libceph: mon0 (1)[c::]:6789 connect error [ 820.807455][T15991] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2669'. [ 822.056616][T15993] trusted_key: encrypted_key: master key parameter 'ž¼' is invalid [ 822.533506][ T30] audit: type=1400 audit(1771332603.966:1598): avc: denied { shutdown } for pid=15986 comm="syz.7.2668" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 823.164755][ T978] usb 8-1: new high-speed USB device number 13 using dummy_hcd [ 823.470104][ T978] usb 8-1: unable to get BOS descriptor or descriptor too short [ 823.539040][ T978] usb 8-1: unable to read config index 0 descriptor/start: -71 [ 823.567433][ T978] usb 8-1: can't read configurations, error -71 [ 824.644410][T16012] FAT-fs (loop11): unable to read boot sector [ 825.050326][ T30] audit: type=1400 audit(1771332606.886:1599): avc: denied { create } for pid=16015 comm="syz.7.2676" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 825.374174][T16018] tipc: Enabled bearer , priority 0 [ 825.433688][ T30] audit: type=1400 audit(1771332606.886:1600): avc: denied { bind } for pid=16015 comm="syz.7.2676" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 825.561095][T16018] syzkaller0: entered promiscuous mode [ 825.603465][T16018] syzkaller0: entered allmulticast mode [ 825.617384][T16018] tipc: Resetting bearer [ 825.669197][T16017] tipc: Resetting bearer [ 825.687049][T16022] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 825.771513][T16022] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 825.824419][T16022] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 825.862158][T16022] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 825.886662][T16022] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 825.912582][T16022] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 825.925975][T16026] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2679'. [ 825.961528][T16026] netlink: 36 bytes leftover after parsing attributes in process `syz.6.2679'. [ 825.985028][T16026] netlink: 264 bytes leftover after parsing attributes in process `syz.6.2679'. [ 826.034123][T16026] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2679'. [ 826.083511][T16026] netlink: 36 bytes leftover after parsing attributes in process `syz.6.2679'. [ 826.103000][T16026] netlink: 264 bytes leftover after parsing attributes in process `syz.6.2679'. [ 826.123344][T16026] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2679'. [ 827.399577][T16043] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 827.713873][T11789] Bluetooth: hci0: command 0x0406 tx timeout [ 827.798009][T11789] Bluetooth: hci2: command 0x0406 tx timeout [ 827.875565][T11789] Bluetooth: hci1: command 0x0406 tx timeout [ 827.875580][T15589] Bluetooth: hci3: command 0x0406 tx timeout [ 827.956873][T11789] Bluetooth: hci5: command 0x0c1a tx timeout [ 827.956896][T15589] Bluetooth: hci4: command 0x0406 tx timeout [ 828.337415][T16017] tipc: Disabling bearer [ 828.501831][ T978] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 828.673560][ T978] usb 5-1: Using ep0 maxpacket: 8 [ 828.686844][ T978] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 828.695608][ T978] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 828.707713][ T978] usb 5-1: config 0 has no interface number 0 [ 828.716142][ T978] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 828.728828][ T978] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 828.745546][ T978] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 828.763689][T13571] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 828.789970][ T978] usb 5-1: config 0 descriptor?? [ 828.820539][ T978] ldusb 5-1:0.55: Interrupt in endpoint not found [ 828.961644][T13571] usb 3-1: unable to get BOS descriptor or descriptor too short [ 828.982042][T13571] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 829.001558][T13571] usb 3-1: can't read configurations, error -71 [ 829.080237][T16056] lo speed is unknown, defaulting to 1000 [ 829.464629][T16061] kvm: pic: non byte write [ 829.939267][T16070] lo speed is unknown, defaulting to 1000 [ 831.145273][ T978] usb 5-1: USB disconnect, device number 90 [ 831.607718][ T5861] usb 6-1: new high-speed USB device number 53 using dummy_hcd [ 831.864113][ T5861] usb 6-1: too many configurations: 53, using maximum allowed: 8 [ 831.891822][ T5861] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 831.911101][ T5861] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 832.319000][ T5861] usb 6-1: Product: syz [ 832.323204][ T5861] usb 6-1: Manufacturer: syz [ 832.328057][ T5861] usb 6-1: SerialNumber: syz [ 832.491383][T16089] FAULT_INJECTION: forcing a failure. [ 832.491383][T16089] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 832.528373][T16089] CPU: 1 UID: 0 PID: 16089 Comm: syz.6.2695 Tainted: G L syzkaller #0 PREEMPT(full) [ 832.528402][T16089] Tainted: [L]=SOFTLOCKUP [ 832.528408][T16089] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 832.528419][T16089] Call Trace: [ 832.528425][T16089] [ 832.528431][T16089] dump_stack_lvl+0x100/0x190 [ 832.528468][T16089] should_fail_ex.cold+0x5/0xa [ 832.528492][T16089] _copy_from_user+0x2e/0xd0 [ 832.528515][T16089] move_addr_to_kernel+0x65/0x170 [ 832.528535][T16089] copy_msghdr_from_user+0x417/0x4f0 [ 832.528553][T16089] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 832.528574][T16089] ? __pfx__kstrtoull+0x10/0x10 [ 832.528605][T16089] ___sys_sendmsg+0x106/0x1e0 [ 832.528624][T16089] ? __pfx____sys_sendmsg+0x10/0x10 [ 832.528655][T16089] ? find_held_lock+0x2b/0x80 [ 832.528692][T16089] __sys_sendmmsg+0x205/0x430 [ 832.528717][T16089] ? __pfx___sys_sendmmsg+0x10/0x10 [ 832.528749][T16089] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 832.528787][T16089] ? fput+0x79/0x100 [ 832.528804][T16089] ? ksys_write+0x1ac/0x250 [ 832.528827][T16089] ? __pfx_ksys_write+0x10/0x10 [ 832.528860][T16089] __x64_sys_sendmmsg+0x9c/0x100 [ 832.528884][T16089] ? lockdep_hardirqs_on+0x78/0x100 [ 832.528908][T16089] do_syscall_64+0x106/0xf80 [ 832.528931][T16089] ? clear_bhb_loop+0x40/0x90 [ 832.528953][T16089] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 832.528971][T16089] RIP: 0033:0x7fa03899bf79 [ 832.528986][T16089] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 832.529003][T16089] RSP: 002b:00007fa039821028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 832.529022][T16089] RAX: ffffffffffffffda RBX: 00007fa038c15fa0 RCX: 00007fa03899bf79 [ 832.529033][T16089] RDX: 0000000000000001 RSI: 0000200000001700 RDI: 0000000000000003 [ 832.529044][T16089] RBP: 00007fa039821090 R08: 0000000000000000 R09: 0000000000000000 [ 832.529055][T16089] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 832.529065][T16089] R13: 00007fa038c16038 R14: 00007fa038c15fa0 R15: 00007ffe8f722358 [ 832.529090][T16089] [ 832.784312][T16080] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2692'. [ 832.810307][ T5861] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 832.838171][ T5861] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 832.902615][T16094] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2697'. [ 833.184540][ T5861] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 833.299522][ T5861] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -71 [ 833.502903][ T5861] usb 6-1: USB disconnect, device number 53 [ 834.379880][T16113] netlink: 'syz.2.2703': attribute type 1 has an invalid length. [ 834.402105][T16117] netlink: 'syz.4.2702': attribute type 1 has an invalid length. [ 834.449551][T16113] bond5: (slave vxcan1): The slave device specified does not support setting the MAC address [ 834.512671][T16113] bond5: (slave vxcan1): Error -95 calling set_mac_address [ 834.543508][ T5861] usb 6-1: new high-speed USB device number 54 using dummy_hcd [ 834.578079][T16117] bond3: (slave vxcan3): The slave device specified does not support setting the MAC address [ 834.589785][T16117] bond3: (slave vxcan3): Error -95 calling set_mac_address [ 834.627164][T16121] bond3: (slave gretap1): making interface the new active one [ 834.638589][T16121] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 834.736506][T16124] macvlan3: entered promiscuous mode [ 834.741825][T16124] macvlan3: entered allmulticast mode [ 834.864404][T16124] bond3: entered promiscuous mode [ 834.869640][T16124] gretap1: entered promiscuous mode [ 834.876153][T16124] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 834.907036][T16124] bond3: (slave macvlan3): the slave hw address is in use by the bond; giving it the hw address of gretap1 [ 834.943945][T16124] bond3: left promiscuous mode [ 834.956443][T16124] gretap1: left promiscuous mode [ 835.002941][T16113] macvlan2: entered promiscuous mode [ 835.033442][T16113] macvlan2: entered allmulticast mode [ 835.068135][T16113] bond5: entered promiscuous mode [ 835.092768][T16113] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 835.167934][T16113] bond5: left promiscuous mode [ 835.248156][ T5861] usb 6-1: unable to get BOS descriptor or descriptor too short [ 835.256668][ T5861] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 835.264347][ T5861] usb 6-1: can't read configurations, error -71 [ 835.737485][T16135] kAFS: unable to lookup cell 'ÿ' [ 835.891874][T16135] kAFS: unable to lookup cell '(,c¾Ì' [ 837.553924][ T2767] block nbd0: Possible stuck request ffff888027d70000: control (read@0,4096B). Runtime 330 seconds [ 837.949746][ T30] audit: type=1400 audit(1771332619.846:1601): avc: denied { accept } for pid=16177 comm="syz.5.2719" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 838.883489][ T5940] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 839.453538][ T793] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 839.504738][ T5940] usb 8-1: Using ep0 maxpacket: 32 [ 839.515982][ T5940] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 158 [ 839.527925][ T5940] usb 8-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 839.538655][ T5940] usb 8-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 839.546876][ T5940] usb 8-1: Product: syz [ 839.551120][ T5940] usb 8-1: Manufacturer: syz [ 839.557746][ T5940] usb 8-1: SerialNumber: syz [ 839.568350][ T5940] usb 8-1: config 0 descriptor?? [ 839.579066][T16179] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 840.212320][ T793] usb 3-1: unable to get BOS descriptor or descriptor too short [ 840.221748][ T793] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 840.229504][T13571] usb 8-1: USB disconnect, device number 15 [ 840.232080][ T793] usb 3-1: config 1 interface 0 altsetting 247 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 840.255136][ T793] usb 3-1: config 1 interface 0 has no altsetting 1 [ 840.263715][ T793] usb 3-1: New USB device found, idVendor=2040, idProduct=b990, bcdDevice=f6.75 [ 840.272937][ T793] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 840.281610][ T793] usb 3-1: Product: syz [ 840.281640][T16207] tipc: Enabled bearer , priority 0 [ 840.285820][ T793] usb 3-1: Manufacturer: syz [ 840.303780][ T793] usb 3-1: SerialNumber: syz [ 840.314421][ T793] smsusb:smsusb_probe: board id=8, interface number 0 [ 840.463675][T16206] tipc: Disabling bearer [ 840.516042][T16190] trusted_key: encrypted_key: master key parameter 'defB°?P' is invalid [ 840.556275][ T30] audit: type=1400 audit(1771332622.456:1602): avc: denied { remount } for pid=16189 comm="syz.2.2723" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 840.588995][T16190] IPv6: Can't replace route, no match found [ 840.611989][ T793] smsusb:smsusb_probe: usb_set_interface failed, rc -71 [ 840.886923][ T793] smsusb 3-1:1.0: probe with driver smsusb failed with error -71 [ 840.935835][ T793] usb 3-1: USB disconnect, device number 78 [ 841.190692][T16228] bond0: entered promiscuous mode [ 841.195811][T16228] bond_slave_0: entered promiscuous mode [ 841.201626][T16228] bond_slave_1: entered promiscuous mode [ 841.208465][T16228] batadv0: entered promiscuous mode [ 841.214580][T16228] batadv0: left promiscuous mode [ 841.503856][T16228] bond0: left promiscuous mode [ 841.508683][T16228] bond_slave_0: left promiscuous mode [ 841.514212][T16228] bond_slave_1: left promiscuous mode [ 841.673161][T16235] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 841.915478][T16240] netlink: 'syz.7.2736': attribute type 1 has an invalid length. [ 842.253867][T16241] tipc: Can't bind to reserved service type 1 [ 842.508634][T16244] bond4: (slave vxcan3): The slave device specified does not support setting the MAC address [ 842.540765][T16244] bond4: (slave vxcan3): Error -95 calling set_mac_address [ 842.631551][T16253] macvlan2: entered promiscuous mode [ 842.641801][T16253] macvlan2: entered allmulticast mode [ 842.648131][T16253] bond4: entered promiscuous mode [ 842.655453][T16253] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 842.678674][T16253] bond4: left promiscuous mode [ 842.723479][ T793] usb 6-1: new high-speed USB device number 56 using dummy_hcd [ 842.737003][T16254] syzkaller0: entered promiscuous mode [ 842.742576][T16254] syzkaller0: entered allmulticast mode [ 842.765679][T16259] tipc: Enabling of bearer rejected, already enabled [ 842.946342][ T793] usb 6-1: Using ep0 maxpacket: 8 [ 843.121838][ T793] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 843.135801][ T793] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 843.169865][ T793] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 17440, setting to 1024 [ 843.191627][ T793] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 843.263816][ T793] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 843.292025][ T793] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 843.304496][ T793] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 843.611061][ T793] usb 6-1: GET_CAPABILITIES returned 0 [ 843.779106][ T793] usbtmc 6-1:16.0: can't read capabilities [ 843.790003][T16279] netlink: 'syz.4.2745': attribute type 2 has an invalid length. [ 843.833009][ T30] audit: type=1400 audit(1771332625.726:1603): avc: denied { connect } for pid=16274 comm="syz.4.2745" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 843.887992][ T793] usb 6-1: USB disconnect, device number 56 [ 843.901072][T16281] netlink: 'syz.4.2745': attribute type 2 has an invalid length. [ 845.196373][ C0] vcan0: j1939_tp_rxtimer: 0xffff888056fbf000: rx timeout, send abort [ 845.204744][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff888056fbf000: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 845.347823][T16306] trusted_key: encrypted_key: insufficient parameters specified [ 845.578339][T16308] tipc: Enabled bearer , priority 0 [ 845.732666][T16307] tipc: Disabling bearer [ 846.047032][T16323] lo speed is unknown, defaulting to 1000 [ 848.164912][ T30] audit: type=1400 audit(1771332630.066:1604): avc: denied { call } for pid=16328 comm="syz.6.2755" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 848.204909][T16330] binder_alloc: 16328: pid 16328 spamming oneway? 1 buffers allocated for a total size of 4096 [ 848.297731][T16337] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2757'. [ 848.316037][T16330] binder: 16328:16330 ioctl c0045006 200000000100 returned -22 [ 848.963570][T16351] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2761'. [ 849.148488][T16355] trusted_key: encrypted_key: insufficient parameters specified [ 850.693789][ T30] audit: type=1400 audit(1771332632.596:1605): avc: denied { create } for pid=16357 comm="syz.4.2764" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 850.770303][ T30] audit: type=1400 audit(1771332632.596:1606): avc: denied { read write } for pid=12388 comm="syz-executor" name="loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 851.038160][T16370] overlayfs: option "index=on" is useless in a non-upper mount, ignore [ 851.075462][ T30] audit: type=1400 audit(1771332632.596:1607): avc: denied { open } for pid=12388 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 851.112962][ T30] audit: type=1400 audit(1771332632.596:1608): avc: denied { ioctl } for pid=12388 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=653 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 851.204866][ T30] audit: type=1400 audit(1771332632.616:1609): avc: denied { write } for pid=16357 comm="syz.4.2764" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 851.348127][T16375] netlink: 34 bytes leftover after parsing attributes in process `syz.6.2767'. [ 851.493562][ T30] audit: type=1400 audit(1771332632.616:1610): avc: denied { read } for pid=16357 comm="syz.4.2764" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 851.536793][T16373] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(7) [ 851.543338][T16373] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 851.556521][T16373] vhci_hcd vhci_hcd.0: Device attached [ 851.570872][ T30] audit: type=1400 audit(1771332632.646:1611): avc: denied { create } for pid=16366 comm="syz.5.2766" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 851.592409][ T30] audit: type=1400 audit(1771332632.656:1612): avc: denied { write } for pid=16366 comm="syz.5.2766" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 851.615509][T16376] vhci_hcd: connection closed [ 851.636115][ T12] vhci_hcd vhci_hcd.4: stop threads [ 851.793745][ T12] vhci_hcd vhci_hcd.4: release socket [ 851.799332][ T12] vhci_hcd vhci_hcd.4: disconnect device [ 851.833572][ T978] usb 41-1: new low-speed USB device number 4 using vhci_hcd [ 851.929327][ T978] usb 41-1: enqueue for inactive port 0 [ 851.955726][ T30] audit: type=1400 audit(1771332632.666:1613): avc: denied { prog_load } for pid=16366 comm="syz.5.2766" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 852.008772][ T30] audit: type=1400 audit(1771332632.696:1614): avc: denied { bpf } for pid=16366 comm="syz.5.2766" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 852.037387][T16386] netlink: 'syz.6.2771': attribute type 10 has an invalid length. [ 852.047500][ T978] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 852.163895][ T5868] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 852.354352][ T5868] usb 3-1: device descriptor read/64, error -71 [ 852.536702][T11789] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 852.547101][T11789] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 852.558274][T11789] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 852.566169][T11789] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 852.577418][T11789] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 852.594642][ T5868] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 852.669926][T16396] lo speed is unknown, defaulting to 1000 [ 852.733800][ T5868] usb 3-1: device descriptor read/64, error -71 [ 852.946791][ T5868] usb usb3-port1: attempt power cycle [ 853.285356][T16412] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=24593 sclass=netlink_route_socket pid=16412 comm=syz.5.2779 [ 853.313575][ T5868] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 853.884697][ T5868] usb 3-1: device descriptor read/8, error -71 [ 854.033638][T16388] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2773'. [ 854.238904][ T5868] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 854.293679][ T5868] usb 3-1: device descriptor read/8, error -71 [ 854.424492][ T5868] usb usb3-port1: unable to enumerate USB device [ 854.682269][T11789] Bluetooth: hci6: command tx timeout [ 855.764060][T16396] chnl_net:caif_netlink_parms(): no params data found [ 856.034428][ T30] kauditd_printk_skb: 76 callbacks suppressed [ 856.034445][ T30] audit: type=1400 audit(1771332637.936:1691): avc: denied { unmount } for pid=12388 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 856.403749][ T30] audit: type=1400 audit(1771332638.296:1692): avc: denied { sqpoll } for pid=16431 comm="syz.5.2780" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 856.464065][ T30] audit: type=1400 audit(1771332638.366:1693): avc: denied { map_create } for pid=16435 comm="syz.2.2786" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 856.554053][ T30] audit: type=1400 audit(1771332638.366:1694): avc: denied { map_read map_write } for pid=16435 comm="syz.2.2786" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 856.557810][ T12] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 856.615175][ T30] audit: type=1400 audit(1771332638.366:1695): avc: denied { prog_run } for pid=16435 comm="syz.2.2786" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 856.780046][T11789] Bluetooth: hci6: command tx timeout [ 857.963436][ T30] audit: type=1400 audit(1771332639.836:1696): avc: denied { setattr } for pid=16440 comm="syz.7.2787" name="76" dev="tmpfs" ino=419 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:" [ 858.077261][T16447] lo speed is unknown, defaulting to 1000 [ 858.431576][T16458] FAT-fs (loop13): unable to read boot sector [ 858.441860][ T30] audit: type=1400 audit(1771332640.326:1697): avc: denied { sys_module } for pid=16455 comm="syz.6.2788" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 858.721640][ T30] audit: type=1400 audit(1771332640.326:1698): avc: denied { mounton } for pid=16455 comm="syz.6.2788" path="/188/file0" dev="tmpfs" ino=1062 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 858.853888][T11789] Bluetooth: hci6: command tx timeout [ 859.130908][ T30] audit: type=1400 audit(1771332640.786:1699): avc: denied { read } for pid=16431 comm="syz.5.2780" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 859.281963][ T30] audit: type=1400 audit(1771332640.786:1700): avc: denied { open } for pid=16431 comm="syz.5.2780" path="/dev/dri/card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 859.472015][T16471] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2791'. [ 859.782545][ T12] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 860.220839][T16469] orangefs_mount: mount request failed with -4 [ 860.396162][T16396] bridge0: port 1(bridge_slave_0) entered blocking state [ 860.403276][T16396] bridge0: port 1(bridge_slave_0) entered disabled state [ 860.449573][T16396] bridge_slave_0: entered allmulticast mode [ 860.464687][T16396] bridge_slave_0: entered promiscuous mode [ 860.504173][ T12] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 860.701685][ T9] usb 8-1: new high-speed USB device number 16 using dummy_hcd [ 860.744011][T16396] bridge0: port 2(bridge_slave_1) entered blocking state [ 860.751572][T16396] bridge0: port 2(bridge_slave_1) entered disabled state [ 860.761719][T16396] bridge_slave_1: entered allmulticast mode [ 860.807929][T16396] bridge_slave_1: entered promiscuous mode [ 860.839740][ T12] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 860.923538][T11789] Bluetooth: hci6: command tx timeout [ 860.970942][ T9] usb 8-1: unable to get BOS descriptor or descriptor too short [ 860.982726][ T9] usb 8-1: unable to read config index 0 descriptor/start: -71 [ 861.008555][ T9] usb 8-1: can't read configurations, error -71 [ 861.112800][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 861.112815][ T30] audit: type=1400 audit(1771332643.006:1703): avc: denied { create } for pid=16481 comm="syz.2.2795" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 861.449202][T16396] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 861.520892][ T30] audit: type=1400 audit(1771332643.116:1704): avc: denied { read } for pid=16481 comm="syz.2.2795" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 861.616456][T16396] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 861.718888][ T30] audit: type=1400 audit(1771332643.596:1705): avc: denied { bind } for pid=16460 comm="syz.6.2790" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 862.053607][ T30] audit: type=1400 audit(1771332643.616:1706): avc: denied { read } for pid=5473 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 862.088902][T16396] team0: Port device team_slave_0 added [ 862.123124][T16396] team0: Port device team_slave_1 added [ 862.130411][ T30] audit: type=1400 audit(1771332643.656:1707): avc: denied { name_bind } for pid=16489 comm="syz.7.2797" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 862.203088][T16396] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 862.210201][ T30] audit: type=1400 audit(1771332643.656:1708): avc: denied { node_bind } for pid=16489 comm="syz.7.2797" saddr=224.0.0.1 src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 862.243545][T16396] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 862.278776][ T30] audit: type=1400 audit(1771332643.666:1709): avc: denied { create } for pid=16489 comm="syz.7.2797" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 862.305820][T16396] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 862.336293][T16396] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 862.346707][ T30] audit: type=1400 audit(1771332644.056:1710): avc: denied { search } for pid=5473 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 862.374367][T16396] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 862.407062][ T30] audit: type=1400 audit(1771332644.056:1711): avc: denied { search } for pid=5473 comm="dhcpcd" name="udev" dev="tmpfs" ino=9 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 862.429763][T16396] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 862.503637][ T30] audit: type=1400 audit(1771332644.056:1712): avc: denied { search } for pid=5473 comm="dhcpcd" name="data" dev="tmpfs" ino=14 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 862.538235][ T12] bridge_slave_1: left allmulticast mode [ 862.546411][ T12] bridge_slave_1: left promiscuous mode [ 862.566702][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 862.619297][ T12] bridge_slave_0: left allmulticast mode [ 862.637087][ T12] bridge_slave_0: left promiscuous mode [ 862.642836][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 863.306677][T16524] rdma_rxe: rxe_newlink: failed to add syz_tun [ 863.462624][ T12] bond3 (unregistering): (slave gretap1): Releasing active interface [ 863.522180][ T12] dvmrp1 (unregistering): left allmulticast mode [ 863.672478][ T12] bond0 (unregistering): left promiscuous mode [ 863.683553][ T12] bond_slave_0: left promiscuous mode [ 863.689194][ T12] bond_slave_1: left promiscuous mode [ 863.716516][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 863.764182][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 863.797032][ T12] bond0 (unregistering): Released all slaves [ 863.826395][ T12] bond1 (unregistering): Released all slaves [ 863.850072][ T12] bond2 (unregistering): Released all slaves [ 863.893219][ T12] bond3 (unregistering): Released all slaves [ 864.011830][T16396] hsr_slave_0: entered promiscuous mode [ 864.053268][T16396] hsr_slave_1: entered promiscuous mode [ 864.061248][T16396] debugfs: 'hsr0' already exists in 'hsr' [ 864.105811][T16396] Cannot create hsr debugfs directory [ 864.120004][T16533] cgroup: Need name or subsystem set [ 864.149320][ T12] tipc: Disabling bearer [ 864.174799][ T12] tipc: Left network mode [ 864.185517][ T9] usb 6-1: new high-speed USB device number 57 using dummy_hcd [ 864.344892][ T9] usb 6-1: config 0 has an invalid interface number: 153 but max is 0 [ 864.358537][ T9] usb 6-1: config 0 has no interface number 0 [ 864.383635][ T5826] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 864.397200][ T9] usb 6-1: too many endpoints for config 0 interface 153 altsetting 255: 255, using maximum allowed: 30 [ 864.453447][ T9] usb 6-1: config 0 interface 153 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 864.453797][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 864.477727][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 864.482758][ T9] usb 6-1: config 0 interface 153 has no altsetting 0 [ 864.546499][ T9] usb 6-1: New USB device found, idVendor=1199, idProduct=6852, bcdDevice=57.34 [ 864.564008][ T5826] usb 3-1: Using ep0 maxpacket: 32 [ 864.581130][ T5826] usb 3-1: New USB device found, idVendor=041e, idProduct=400b, bcdDevice=3e.e7 [ 864.605672][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 864.613477][ T5868] usb 8-1: new high-speed USB device number 18 using dummy_hcd [ 864.643683][ T5826] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 864.668817][ T9] usb 6-1: Product: syz [ 864.682875][ T9] usb 6-1: Manufacturer: syz [ 864.688140][ T5826] usb 3-1: config 0 descriptor?? [ 864.694690][ T9] usb 6-1: SerialNumber: syz [ 864.701481][ T5826] gspca_main: sunplus-2.14.0 probing 041e:400b [ 864.711718][ T9] usb 6-1: config 0 descriptor?? [ 864.907498][ T5868] usb 8-1: unable to get BOS descriptor or descriptor too short [ 864.927358][ T5868] usb 8-1: unable to read config index 0 descriptor/start: -71 [ 864.948282][ T5868] usb 8-1: can't read configurations, error -71 [ 864.954373][ T9] sierra 6-1:0.153: Sierra USB modem converter detected [ 865.002267][ T9] usb 6-1: USB disconnect, device number 57 [ 865.010776][ T9] sierra 6-1:0.153: device disconnected [ 865.337669][ T12] batadv0: left promiscuous mode [ 865.359770][ T12] hsr_slave_0: left promiscuous mode [ 865.370130][ T12] hsr_slave_1: left promiscuous mode [ 865.380197][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 865.411879][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 865.484869][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 865.519554][T16556] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 865.529431][T16556] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 865.550899][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 865.618295][ T12] batman_adv: batadv0: Interface deactivated: vlan1 [ 865.625673][ T5826] gspca_sunplus: reg_r err -110 [ 865.635782][ T5826] sunplus 3-1:0.0: probe with driver sunplus failed with error -110 [ 865.645860][ T12] batman_adv: batadv0: Removing interface: vlan1 [ 865.718357][ T12] dummy0: left allmulticast mode [ 865.750928][ T12] veth1_macvtap: left promiscuous mode [ 865.757206][ T12] veth0_macvtap: left promiscuous mode [ 865.766817][ T12] veth1_vlan: left promiscuous mode [ 865.811895][ T12] veth0_vlan: left promiscuous mode [ 866.222618][ T30] kauditd_printk_skb: 29 callbacks suppressed [ 866.222655][ T30] audit: type=1400 audit(1771332648.116:1742): avc: denied { write } for pid=16564 comm="syz.5.2809" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 866.741904][ T12] team0 (unregistering): Port device team_slave_1 removed [ 866.770199][ T12] team0 (unregistering): Port device team_slave_0 removed [ 866.972067][ T5826] lo speed is unknown, defaulting to 1000 [ 866.979107][T16570] syzkaller0: entered promiscuous mode [ 866.986013][ T5826] infiniband syz0: ib_query_port failed (-19) [ 866.992105][T16570] syzkaller0: entered allmulticast mode [ 867.193506][ T30] audit: type=1400 audit(1771332649.086:1743): avc: denied { write } for pid=16590 comm="syz.6.2810" lport=5 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 867.338105][T16396] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 867.421316][T16396] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 867.436262][ T30] audit: type=1400 audit(1771332649.336:1744): avc: denied { ioctl } for pid=16600 comm="syz.7.2812" path="/dev/vhost-vsock" dev="devtmpfs" ino=1275 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 867.667698][ T2767] block nbd0: Possible stuck request ffff888027d70000: control (read@0,4096B). Runtime 360 seconds [ 867.871951][ T30] audit: type=1400 audit(1771332649.366:1745): avc: denied { append } for pid=16590 comm="syz.6.2810" name="001" dev="devtmpfs" ino=721 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 867.945736][T16396] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 868.113780][ T30] audit: type=1400 audit(1771332649.996:1746): avc: denied { write } for pid=16607 comm="syz.5.2813" name="ptp0" dev="devtmpfs" ino=1265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 868.145609][ T5826] usb 3-1: USB disconnect, device number 83 [ 868.173250][T16396] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 868.235550][ T30] audit: type=1400 audit(1771332649.996:1747): avc: denied { open } for pid=16607 comm="syz.5.2813" path="/dev/ptp0" dev="devtmpfs" ino=1265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 868.298306][ T30] audit: type=1400 audit(1771332649.996:1748): avc: denied { write } for pid=16607 comm="syz.5.2813" name="ip6_tables_matches" dev="proc" ino=4026534181 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 868.851907][T16624] netlink: 'syz.2.2816': attribute type 1 has an invalid length. [ 869.394839][ T30] audit: type=1400 audit(1771332650.886:1749): avc: denied { connect } for pid=16625 comm="syz.7.2815" lport=7 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 869.411631][T16396] 8021q: adding VLAN 0 to HW filter on device bond0 [ 869.434610][T16396] 8021q: adding VLAN 0 to HW filter on device team0 [ 869.454233][T16624] bond6: (slave vxcan1): The slave device specified does not support setting the MAC address [ 869.465502][T16624] bond6: (slave vxcan1): Error -95 calling set_mac_address [ 869.498886][ T30] audit: type=1400 audit(1771332651.396:1750): avc: denied { create } for pid=16623 comm="syz.2.2816" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 869.539235][T16635] macvlan2: entered promiscuous mode [ 869.544787][T16635] macvlan2: entered allmulticast mode [ 869.551008][T16635] bond6: entered promiscuous mode [ 869.562527][ T30] audit: type=1400 audit(1771332651.426:1751): avc: denied { write } for pid=16623 comm="syz.2.2816" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 869.573450][T16635] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 869.628828][T16635] bond6: left promiscuous mode [ 869.690421][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 869.697600][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 869.760618][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 869.767783][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 869.992894][T16396] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 870.006804][ T5875] usb 6-1: new high-speed USB device number 58 using dummy_hcd [ 870.093457][ T5826] usb 8-1: new full-speed USB device number 20 using dummy_hcd [ 870.165000][ T5875] usb 6-1: config 0 has an invalid interface number: 153 but max is 0 [ 870.175525][ T5875] usb 6-1: config 0 has no interface number 0 [ 870.181625][ T5875] usb 6-1: too many endpoints for config 0 interface 153 altsetting 255: 255, using maximum allowed: 30 [ 870.195047][ T5875] usb 6-1: config 0 interface 153 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 870.234520][ T5875] usb 6-1: config 0 interface 153 has no altsetting 0 [ 870.244488][ T12] IPVS: stop unused estimator thread 0... [ 870.245349][ T5826] usb 8-1: config 0 has an invalid interface number: 113 but max is 0 [ 870.259900][ T5875] usb 6-1: New USB device found, idVendor=1199, idProduct=6852, bcdDevice=57.34 [ 870.278547][ T5875] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 870.280633][ T5826] usb 8-1: config 0 has no interface number 0 [ 870.287338][T16396] veth0_vlan: entered promiscuous mode [ 870.299769][ T5875] usb 6-1: Product: syz [ 870.307881][ T5826] usb 8-1: config 0 interface 113 altsetting 2 has an endpoint descriptor with address 0x14, changing to 0x4 [ 870.321852][ T5875] usb 6-1: Manufacturer: syz [ 870.329636][ T5826] usb 8-1: config 0 interface 113 altsetting 2 endpoint 0x82 has invalid maxpacket 43115, setting to 64 [ 870.329687][T16396] veth1_vlan: entered promiscuous mode [ 870.353572][ T5875] usb 6-1: SerialNumber: syz [ 870.360568][ T5875] usb 6-1: config 0 descriptor?? [ 870.371603][ T5826] usb 8-1: config 0 interface 113 has no altsetting 0 [ 870.393249][ T5826] usb 8-1: New USB device found, idVendor=054c, idProduct=02e1, bcdDevice=e2.c8 [ 870.403657][ T5826] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 870.414751][ T5826] usb 8-1: Product: syz [ 870.418967][ T5826] usb 8-1: Manufacturer: syz [ 870.444574][ T5826] usb 8-1: SerialNumber: syz [ 870.448055][T16396] veth0_macvtap: entered promiscuous mode [ 870.460947][ T5826] usb 8-1: config 0 descriptor?? [ 870.463746][T16396] veth1_macvtap: entered promiscuous mode [ 870.478963][T16648] raw-gadget.2 gadget.7: fail, usb_ep_enable returned -22 [ 870.488436][T16396] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 870.502175][ C0] usb 8-1: NFC: Urb failure (status -71) [ 870.519063][ C0] usb 8-1: NFC: Urb failure (status -71) [ 870.526552][T16396] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 870.536055][ T5826] usb 8-1: NFC: Unable to get FW version [ 870.554015][ T5826] pn533_usb 8-1:0.113: probe with driver pn533_usb failed with error -71 [ 870.556728][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 870.578505][ T5875] sierra 6-1:0.153: Sierra USB modem converter detected [ 870.616978][ T5875] usb 6-1: USB disconnect, device number 58 [ 870.625008][ T5875] sierra 6-1:0.153: device disconnected [ 870.636856][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 870.669442][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 870.681827][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 870.808151][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 870.836682][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 870.837294][ T31] INFO: task syz.0.2313:14612 blocked for more than 143 seconds. SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 870.886975][ T31] Tainted: G L syzkaller #0 [ 870.903435][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 870.913482][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 870.921719][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 870.952863][ T31] task:syz.0.2313 state:D stack:28792 pid:14612 tgid:14611 ppid:5803 task_flags:0x400040 flags:0x00080002 [ 870.975153][T16688] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 871.019460][ T31] Call Trace: [ 871.022779][ T31] [ 871.047118][ T31] __schedule+0xfee/0x60e0 [ 871.051591][ T31] ? __lock_acquire+0x4a5/0x2630 [ 871.184421][ T31] ? __pfx___schedule+0x10/0x10 [ 871.195632][ T31] ? find_held_lock+0x2b/0x80 [ 871.200358][ T31] ? schedule+0x2bf/0x390 [ 871.213688][ T31] schedule+0xdd/0x390 [ 871.217811][ T31] schedule_preempt_disabled+0x13/0x30 [ 871.223284][ T31] __mutex_lock+0xc9a/0x1b90 [ 871.243479][ T31] ? bdev_open+0x41a/0xe40 [ 871.248512][ T31] ? find_held_lock+0x2b/0x80 [ 871.253215][ T31] ? find_inode_fast+0x5e3/0x910 [ 871.273455][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 871.278532][ T31] ? find_inode_fast+0x1fa/0x910 [ 871.283906][ T31] ? bdev_open+0x41a/0xe40 [ 871.288340][ T31] bdev_open+0x41a/0xe40 [ 871.297642][ T31] ? iput+0x3a/0x40 [ 871.301460][ T31] blkdev_open+0x34e/0x4f0 [ 871.323495][ T31] do_dentry_open+0x6d8/0x1660 [ 871.329162][ T31] ? __pfx_blkdev_open+0x10/0x10 [ 871.334712][ T31] vfs_open+0x82/0x3f0 [ 871.338801][ T31] path_openat+0x208c/0x31a0 [ 871.344316][ T31] ? __pfx_path_openat+0x10/0x10 [ 871.349310][ T31] do_file_open+0x20e/0x430 [ 871.354461][ T31] ? __pfx_do_file_open+0x10/0x10 [ 871.359634][ T31] ? alloc_fd+0x476/0x790 [ 871.364747][ T31] ? do_getname+0x191/0x390 [ 871.369268][ T31] do_sys_openat2+0x10d/0x1e0 [ 871.374193][ T31] ? __pfx_do_sys_openat2+0x10/0x10 [ 871.379405][ T31] __x64_sys_openat+0x12d/0x210 [ 871.384465][ T31] ? __pfx___x64_sys_openat+0x10/0x10 [ 871.389840][ T31] ? __pfx___schedule+0x10/0x10 [ 871.395115][ T31] ? do_user_addr_fault+0x8d6/0x12f0 [ 871.400414][ T31] do_syscall_64+0x106/0xf80 [ 871.406561][ T31] ? clear_bhb_loop+0x40/0x90 [ 871.411250][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 871.417274][ T31] RIP: 0033:0x7f2e08b5c84e [ 871.421692][ T31] RSP: 002b:00007f2e09a32b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 871.430953][ T31] RAX: ffffffffffffffda RBX: 00007f2e09a336c0 RCX: 00007f2e08b5c84e [ 871.439196][ T31] RDX: 0000000000000400 RSI: 00007f2e09a32c00 RDI: ffffffffffffff9c [ 871.447227][ T31] RBP: 00007f2e09a32c00 R08: 0000000000000000 R09: 0000000000000000 [ 871.456146][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 871.464145][ T31] R13: 00007f2e08e16038 R14: 00007f2e08e15fa0 R15: 00007ffdb0ad8288 [ 871.472117][ T31] [ 871.487980][ T31] [ 871.487980][ T31] Showing all locks held in the system: [ 871.513543][ T31] 1 lock held by khungtaskd/31: [ 871.522401][ T31] #0: ffffffff8e7e93e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 871.532767][ T31] 5 locks held by kworker/u8:4/63: [ 871.545819][ T31] #0: ffff8880b843b1a0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x88/0x140 [ 871.563653][ T31] #1: ffff8880b8524648 (psi_seq){-.-.}-{0:0}, at: __schedule+0x2c11/0x60e0 [ 871.572419][ T31] #2: ffff8880b8526358 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x124/0x1d0 [ 871.623441][ T31] #3: ffffffff9b36ec58 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_activate+0x144/0x490 [ 871.663407][ T31] #4: ffffffff8e7e93e0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xbd/0x1ea0 [ 871.673148][ T31] 3 locks held by kworker/1:2/978: [ 871.703449][ T31] 3 locks held by kworker/u8:9/1317: [ 871.708785][ T31] #0: ffff888033753948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 [ 871.763425][ T31] #1: ffffc900050cfd08 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 [ 871.793822][ T31] #2: ffffffff9060f4a8 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x11f/0x1360 [ 871.823489][ T31] 2 locks held by getty/5562: [ 871.828197][ T31] #0: ffff8880385230a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 871.839831][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 [ 871.850229][ T31] 3 locks held by kworker/0:4/5861: [ 871.859824][ T31] #0: ffff88813fe63548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 [ 871.873402][ T31] #1: ffffc90004397d08 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 [ 871.883089][ T31] #2: ffffffff8e7f4ff8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 [ 871.893326][ T31] 3 locks held by kworker/1:5/5875: [ 871.898543][ T31] #0: ffff88813fe63548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 [ 871.909090][ T31] #1: ffffc9000448fd08 ((fqdir_free_work).work){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 [ 871.920437][ T31] #2: ffffffff8e7f4ec0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x48/0x6d0 [ 871.930432][ T31] 1 lock held by udevd/10442: [ 871.935324][ T31] #0: ffff888027c3e358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 871.945449][ T31] 1 lock held by syz.6.2206/14211: [ 871.950541][ T31] #0: ffffffff9060f4a8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 [ 871.961383][ T31] 1 lock held by syz.0.2313/14612: [ 871.969236][ T31] #0: ffff888027c3e358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 871.978607][ T31] 1 lock held by syz-executor/16396: [ 871.983889][ T31] #0: ffffffff8e7f4ff8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 [ 871.993914][ T31] 1 lock held by syz.5.2777/16406: [ 871.999005][ T31] #0: ffffffff9060f4a8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 [ 872.008010][ T31] 1 lock held by syz.7.2819/16647: [ 872.013107][ T31] #0: ffffffff9060f4a8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 [ 872.022072][ T31] 1 lock held by syz.2.2822/16688: [ 872.027361][ T31] #0: ffff88807a0ac0e0 (&type->s_umount_key#71){++++}-{4:4}, at: deactivate_super+0xdf/0x110 [ 872.038015][ T31] 1 lock held by dhcpcd/16692: [ 872.042861][ T31] #0: ffff88803529a260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x2c/0xf50 [ 872.053249][ T31] 1 lock held by dhcpcd/16693: [ 872.058042][ T31] #0: ffff888035108260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x2c/0xf50 [ 872.068198][ T31] [ 872.070524][ T31] ============================================= [ 872.070524][ T31] [ 872.103429][ T31] NMI backtrace for cpu 1 [ 872.103451][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 872.103473][ T31] Tainted: [L]=SOFTLOCKUP [ 872.103478][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 872.103487][ T31] Call Trace: [ 872.103493][ T31] [ 872.103499][ T31] dump_stack_lvl+0x100/0x190 [ 872.103529][ T31] nmi_cpu_backtrace.cold+0x12d/0x151 [ 872.103547][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 872.103572][ T31] nmi_trigger_cpumask_backtrace+0x1d7/0x230 [ 872.103593][ T31] sys_info+0x141/0x190 [ 872.103619][ T31] watchdog+0xd25/0x1050 [ 872.103650][ T31] ? __pfx_watchdog+0x10/0x10 [ 872.103672][ T31] ? __kthread_parkme+0x18c/0x230 [ 872.103700][ T31] ? kthread+0x13a/0x450 [ 872.103714][ T31] ? __pfx_watchdog+0x10/0x10 [ 872.103743][ T31] kthread+0x370/0x450 [ 872.103758][ T31] ? __pfx_kthread+0x10/0x10 [ 872.103775][ T31] ret_from_fork+0x754/0xd80 [ 872.103794][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 872.103813][ T31] ? __switch_to+0x7b4/0x1120 [ 872.103834][ T31] ? __pfx_kthread+0x10/0x10 [ 872.103850][ T31] ret_from_fork_asm+0x1a/0x30 [ 872.103886][ T31] [ 872.103893][ T31] Sending NMI from CPU 1 to CPUs 0: [ 872.233236][ C0] NMI backtrace for cpu 0 [ 872.233255][ C0] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Tainted: G L syzkaller #0 PREEMPT(full) [ 872.233275][ C0] Tainted: [L]=SOFTLOCKUP [ 872.233279][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 872.233289][ C0] Workqueue: events drain_vmap_area_work [ 872.233314][ C0] RIP: 0010:unwind_next_frame+0x23d/0x1ea0 [ 872.233333][ C0] Code: 89 74 24 20 89 44 24 18 e8 90 e9 bc 00 48 8b 4c 24 30 48 8b 44 24 28 8b 74 24 20 44 8b 5c 24 18 8d 50 01 8b 0c 8d 50 63 33 92 <48> b8 00 00 00 00 00 fc ff df 48 8d 3c 95 50 63 33 92 49 89 f8 49 [ 872.233346][ C0] RSP: 0018:ffffc900000e7600 EFLAGS: 00000246 [ 872.233361][ C0] RAX: 0000000000016251 RBX: 0000000000000001 RCX: 000000000003d41d [ 872.233369][ C0] RDX: 0000000000016252 RSI: 00000000000a92ef RDI: ffffffff9238ec94 [ 872.233378][ C0] RBP: ffffc900000e76b8 R08: 0000000000000000 R09: 0000000000000007 [ 872.233386][ C0] R10: 0000000000000200 R11: 0000000000016251 R12: ffffc900000e76c0 [ 872.233395][ C0] R13: ffffc900000e7670 R14: ffffc900000e76a5 R15: ffffffff8262511f [ 872.233405][ C0] FS: 0000000000000000(0000) GS:ffff88812434d000(0000) knlGS:0000000000000000 [ 872.233420][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 872.233430][ C0] CR2: 00007f49d4f9cfb3 CR3: 0000000038676000 CR4: 00000000003526f0 [ 872.233439][ C0] Call Trace: [ 872.233444][ C0] [ 872.233451][ C0] ? purge_vmap_node+0x210/0xb40 [ 872.233480][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 872.233501][ C0] arch_stack_walk+0x94/0xf0 [ 872.233520][ C0] ? purge_vmap_node+0x210/0xb40 [ 872.233541][ C0] stack_trace_save+0x8e/0xc0 [ 872.233559][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 872.233576][ C0] ? __lock_acquire+0x4a5/0x2630 [ 872.233598][ C0] save_stack+0x162/0x1e0 [ 872.233616][ C0] ? __pfx_save_stack+0x10/0x10 [ 872.233631][ C0] ? __free_frozen_pages+0x7ca/0x10a0 [ 872.233644][ C0] ? kasan_depopulate_vmalloc_pte+0x5d/0x80 [ 872.233660][ C0] ? __apply_to_page_range+0xb1d/0x1520 [ 872.233674][ C0] ? __kasan_release_vmalloc+0xd7/0xe0 [ 872.233689][ C0] ? purge_vmap_node+0x210/0xb40 [ 872.233708][ C0] ? page_ext_put+0x3e/0xd0 [ 872.233727][ C0] __reset_page_owner+0x84/0x190 [ 872.233745][ C0] __free_frozen_pages+0x7ca/0x10a0 [ 872.233760][ C0] ? __pfx_kasan_depopulate_vmalloc_pte+0x10/0x10 [ 872.233777][ C0] kasan_depopulate_vmalloc_pte+0x5d/0x80 [ 872.233792][ C0] __apply_to_page_range+0xb1d/0x1520 [ 872.233808][ C0] ? __pfx_kasan_depopulate_vmalloc_pte+0x10/0x10 [ 872.233826][ C0] ? __pfx___apply_to_page_range+0x10/0x10 [ 872.233840][ C0] ? find_held_lock+0x2b/0x80 [ 872.233855][ C0] ? purge_vmap_node+0x864/0xb40 [ 872.233872][ C0] ? purge_vmap_node+0x864/0xb40 [ 872.233891][ C0] __kasan_release_vmalloc+0xd7/0xe0 [ 872.233907][ C0] purge_vmap_node+0x210/0xb40 [ 872.233928][ C0] ? __pfx_purge_vmap_node+0x10/0x10 [ 872.233945][ C0] ? on_each_cpu_cond_mask+0x63/0x90 [ 872.233965][ C0] __purge_vmap_area_lazy+0x935/0xc20 [ 872.233985][ C0] drain_vmap_area_work+0x27/0x40 [ 872.234002][ C0] process_one_work+0x9d7/0x1920 [ 872.234020][ C0] ? __pfx_process_one_work+0x10/0x10 [ 872.234036][ C0] ? __pfx_drain_vmap_area_work+0x10/0x10 [ 872.234055][ C0] worker_thread+0x5da/0xe40 [ 872.234072][ C0] ? kthread+0x13a/0x450 [ 872.234083][ C0] ? __pfx_worker_thread+0x10/0x10 [ 872.234095][ C0] kthread+0x370/0x450 [ 872.234106][ C0] ? __pfx_kthread+0x10/0x10 [ 872.234118][ C0] ret_from_fork+0x754/0xd80 [ 872.234132][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 872.234146][ C0] ? __switch_to+0x7b4/0x1120 [ 872.234161][ C0] ? __pfx_kthread+0x10/0x10 [ 872.234174][ C0] ret_from_fork_asm+0x1a/0x30 [ 872.234194][ C0] [ 872.241752][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 872.241772][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 872.241795][ T31] Tainted: [L]=SOFTLOCKUP [ 872.241801][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 872.241811][ T31] Call Trace: [ 872.241817][ T31] [ 872.241824][ T31] dump_stack_lvl+0x100/0x190 [ 872.241854][ T31] vpanic+0x552/0x970 [ 872.241871][ T31] ? __pfx_vpanic+0x10/0x10 [ 872.241888][ T31] ? rcu_is_watching+0x12/0xc0 [ 872.241909][ T31] panic+0xd1/0xe0 [ 872.241924][ T31] ? __pfx_panic+0x10/0x10 [ 872.241942][ T31] ? nmi_trigger_cpumask_backtrace+0x1b5/0x230 [ 872.241961][ T31] ? nmi_trigger_cpumask_backtrace+0x1f6/0x230 [ 872.241978][ T31] ? nmi_trigger_cpumask_backtrace+0x200/0x230 [ 872.241994][ T31] ? watchdog.cold+0x198/0x1ca [ 872.242011][ T31] ? watchdog+0xd35/0x1050 [ 872.242031][ T31] watchdog.cold+0x1a9/0x1ca [ 872.242054][ T31] ? __pfx_watchdog+0x10/0x10 [ 872.242074][ T31] ? __kthread_parkme+0x18c/0x230 [ 872.242098][ T31] ? kthread+0x13a/0x450 [ 872.242111][ T31] ? __pfx_watchdog+0x10/0x10 [ 872.242129][ T31] kthread+0x370/0x450 [ 872.242142][ T31] ? __pfx_kthread+0x10/0x10 [ 872.242158][ T31] ret_from_fork+0x754/0xd80 [ 872.242175][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 872.242192][ T31] ? __switch_to+0x7b4/0x1120 [ 872.242211][ T31] ? __pfx_kthread+0x10/0x10 [ 872.242226][ T31] ret_from_fork_asm+0x1a/0x30 [ 872.242254][ T31] [ 872.745449][ T31] Kernel Offset: disabled [ 872.749750][ T31] Rebooting in 86400 seconds..