last executing test programs: 38m43.89001909s ago: executing program 4 (id=1784): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000000780)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x2122, 0x0) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000000)=0x400000d2, 0x4) shutdown(r0, 0x0) 38m43.691742463s ago: executing program 4 (id=1786): syz_emit_ethernet(0x2a, &(0x7f0000000100)=ANY=[@ANYBLOB="0180c200000eaaaaaaaaaabb08004500001c00000000008d0a6284375a8926141415384e4dbea862106c"], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_int(r0, 0x0, 0x16, 0x0, &(0x7f0000000180)) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) r3 = syz_open_dev$video4linux(&(0x7f0000000480), 0x5, 0x161040) ioctl$VIDIOC_SUBDEV_S_FMT(r3, 0xc0585605, &(0x7f0000000000)={0x0, 0x0, {0x401, 0xfffffffc, 0x300f, 0x0, 0x1, 0xf30, 0x2, 0x6}}) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/cpuinfo\x00', 0x0, 0x0) pread64(r4, &(0x7f00000007c0)=""/222, 0xde, 0x18000000000000) socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$kvm(0x0, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_HAS_DEVICE_ATTR(r4, 0x4018aee3, 0x0) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r6, 0x40505330, &(0x7f0000000040)={{}, {0x18}, 0x0, 0x7}) quotactl$Q_GETQUOTA(0xffffffff80000702, 0x0, 0x0, &(0x7f0000000300)) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0}, 0x18) socket$vsock_stream(0x28, 0x1, 0x0) 38m42.344134071s ago: executing program 4 (id=1791): r0 = syz_open_procfs(0x0, &(0x7f0000000040)='map_files\x00') bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) write$binfmt_aout(0xffffffffffffffff, 0x0, 0xa20) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) r4 = openat$kvm(0x0, 0x0, 0x2382, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000380)=@generic={&(0x7f0000000340)='./file0\x00', 0x0, 0x18}, 0x18) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$vim2m_VIDIOC_S_FMT(r5, 0xc0d05605, &(0x7f0000000240)={0x1, @pix_mp={0x0, 0x0, 0x50424752, 0x0, 0xd, [{}, {}, {}, {0xf, 0xd}, {}, {0x0, 0xfffffffe}, {0x7}], 0x0, 0x0, 0x0, 0x0, 0x6}}) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) umount2(&(0x7f00000001c0)='./file0\x00', 0x0) sendmmsg$inet6(r0, &(0x7f0000000340), 0x0, 0x10000055) 38m41.385256743s ago: executing program 4 (id=1793): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r0, 0x0) setpgid(0x0, r0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x4) 38m41.22179576s ago: executing program 4 (id=1795): r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000001c0)={'vlan0\x00', &(0x7f0000000180)=@ethtool_link_settings={0x4c, 0xa, 0x81, 0x0, 0x9, 0x1, 0x5, 0x80, 0x41, 0x4, [0x8, 0x4, 0xe18, 0x972d, 0x3, 0x7, 0x6, 0x3]}}) 38m40.807874436s ago: executing program 4 (id=1800): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x3) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0x13, &(0x7f0000000240)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_emit_vhci(&(0x7f0000000280)=@HCI_EVENT_PKT={0x4, @HCI_EV_VENDOR={{0xff, 0x1}, "02"}}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x1a01, 0x0) ioctl$EVIOCGPROP(r1, 0x40047438, &(0x7f0000000180)=""/246) 38m40.336366675s ago: executing program 32 (id=1800): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x3) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0x13, &(0x7f0000000240)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_emit_vhci(&(0x7f0000000280)=@HCI_EVENT_PKT={0x4, @HCI_EV_VENDOR={{0xff, 0x1}, "02"}}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x1a01, 0x0) ioctl$EVIOCGPROP(r1, 0x40047438, &(0x7f0000000180)=""/246) 22m12.199096097s ago: executing program 0 (id=5394): syz_open_dev$loop(&(0x7f00000005c0), 0xffff, 0x109041) socketpair$unix(0x1, 0x3, 0x0, 0x0) r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, 0x0) close(r0) io_uring_register$IORING_REGISTER_PBUF_RING(0xffffffffffffffff, 0x1f, &(0x7f00000004c0)={0x0}, 0x1) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) r1 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r1, &(0x7f00000017c0), 0x0, 0x0) r2 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_io_uring_setup(0x495, &(0x7f0000000400)={0x0, 0x7079, 0x0, 0x3, 0xd7}, 0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, r5, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r3, 0x4, 0x0}) io_uring_enter(r4, 0x3516, 0x0, 0x0, 0x0, 0x0) 22m12.097197894s ago: executing program 0 (id=5396): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, 0x0) connect$inet6(r0, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, 0x0, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='virtio_transport_alloc_pkt\x00', r1}, 0x18) r2 = socket$vsock_stream(0x28, 0x1, 0x0) fcntl$addseals(0xffffffffffffffff, 0x409, 0x5) r3 = socket$kcm(0xa, 0x1, 0x106) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$tty20(0xc, 0x4, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$EVIOCGKEY(0xffffffffffffffff, 0x80404518, &(0x7f00000004c0)=""/94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x8000002000000, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NL80211_CMD_RELOAD_REGDB(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)={0x14, r7, 0x101, 0x70bd2c, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="340000003e000900000000000008000003"], 0x34}}, 0x84) close(r3) bind$vsock_stream(r2, 0x0, 0x0) listen(r2, 0x0) r8 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r8, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) connect$vsock_stream(r8, &(0x7f0000000040)={0x28, 0x0, 0x2710, @my=0x0}, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) 22m8.994717911s ago: executing program 0 (id=5406): syz_open_dev$loop(&(0x7f00000005c0), 0xffff, 0x109041) socketpair$unix(0x1, 0x3, 0x0, 0x0) r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, 0x0) close(r0) io_uring_register$IORING_REGISTER_PBUF_RING(0xffffffffffffffff, 0x1f, &(0x7f00000004c0)={0x0}, 0x1) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) r1 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r1, &(0x7f00000017c0), 0x0, 0x0) r2 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_io_uring_setup(0x495, &(0x7f0000000400)={0x0, 0x7079, 0x0, 0x3, 0xd7}, &(0x7f0000000340)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, 0x0, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r3, 0x4, 0x0}) io_uring_enter(r4, 0x3516, 0x0, 0x0, 0x0, 0x0) 22m8.563190615s ago: executing program 0 (id=5408): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x141802, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x3c}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r2) sendmsg$DEVLINK_CMD_SB_POOL_SET(r2, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x25004000}, 0xc, &(0x7f0000000280)={&(0x7f0000000500)={0x200, r3, 0x800, 0x70bd28, 0x25dfdbfc, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x8001}, {0x6, 0x11, 0x7}, {0x8, 0x13, 0x80000000}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x355b}, {0x6, 0x11, 0x4}, {0x8}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x2}, {0x6, 0x11, 0x8}, {0x8, 0x13, 0x6}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x8}, {0x6, 0x11, 0x4}, {0x8}, {0x5, 0x14, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x8}, {0x6, 0x11, 0x9}, {0x8, 0x13, 0x9}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x9}, {0x6, 0x11, 0x2ed}, {0x8, 0x13, 0x8000}, {0x5, 0x14, 0x1}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x2}, {0x6, 0x11, 0x90}, {0x8, 0x13, 0xfffffffe}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0xa3a9}, {0x6, 0x11, 0x4}, {0x8, 0x13, 0x5}, {0x5, 0x14, 0x1}}]}, 0x200}, 0x1, 0x0, 0x0, 0x11}, 0x20000000) r4 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r4, &(0x7f0000000240)={0xa, 0x2, 0x1000, @empty}, 0x1c) syz_emit_ethernet(0x3e, &(0x7f0000000400)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, @void, {@ipv6={0x86dd, @icmpv6={0x1, 0x6, "fbddf0", 0x8, 0x3a, 0xff, @remote, @mcast2, {[], @echo_reply={0x81, 0x0, 0x0, 0x2, 0x8}}}}}}, 0x0) ioctl$vim2m_VIDIOC_S_CTRL(r2, 0xc008561c, &(0x7f0000000380)={0x0, 0x3}) recvfrom(r4, 0x0, 0x0, 0x100, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000002c0)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f326635004000000f300f20e06635800000000f22e0f30fa6c8", 0x50}], 0x1, 0x0, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='fd', @ANYBLOB=',rootmode=00000000000000000040000,use']) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f00000004c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0}, 0x10) ioctl$KVM_RUN(r5, 0xae80, 0x0) 22m7.855552942s ago: executing program 0 (id=5412): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000005000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) syz_io_uring_setup(0x6148, &(0x7f0000000340)={0x0, 0x13ea, 0x2, 0x2, 0x3c6}, &(0x7f0000000040), &(0x7f0000000140)) socket$inet6_udplite(0xa, 0x2, 0x88) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x3, &(0x7f0000000080)=0x7) r0 = getpid() bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r4 = open(&(0x7f0000000000)='.\x00', 0x800000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000800), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) chroot(&(0x7f00000001c0)='./file0/../file0/../file0\x00') ioctl$AUTOFS_IOC_PROTOSUBVER(r4, 0x40049366, 0x0) r6 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x0, @private0, @private2, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r6, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_ATOMIC(r6, 0xc03864bc, &(0x7f0000000500)={0x402, 0x0, 0x0, 0x0, 0x0, 0x0}) 22m4.85556861s ago: executing program 0 (id=5425): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(0xffffffffffffffff, 0xc1105511, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x10) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x8010, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000580)={0x1ff, 0x0, 0x0, 0x1000, &(0x7f0000456000/0x1000)=nil}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000004c0)={{0x2, 0x0, 0x0, 0x0, 0x0, 0x20}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x5000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd}, {0x0, 0x2000, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8d}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd, 0x0, 0x80}, {}, {}, 0x0, 0x0, 0x0, 0x100}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r0, 0xc0bc5351, &(0x7f0000000380)={0x1, 0x1, 'client1\x00', 0x0, "54c2274d9f3ae6ff", "a7a5e94547b838c4df89588cfbf0df612d8b02afe9660ce9b1af9f674d637d47", 0x5c3, 0x1}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x28801, 0x0) write$FUSE_CREATE_OPEN(0xffffffffffffffff, 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x42280, 0x0) close(r4) ioctl$KVM_CHECK_EXTENSION(r5, 0xae01, 0x1) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r4, 0x4020aed2, &(0x7f0000000040)={0x0, 0x399000, 0x8}) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r4, 0x4020aed2, &(0x7f0000000080)={0x1000, 0x100000, 0x8}) 21m49.409121822s ago: executing program 33 (id=5425): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(0xffffffffffffffff, 0xc1105511, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x10) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x8010, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000580)={0x1ff, 0x0, 0x0, 0x1000, &(0x7f0000456000/0x1000)=nil}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000004c0)={{0x2, 0x0, 0x0, 0x0, 0x0, 0x20}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x5000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd}, {0x0, 0x2000, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8d}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd, 0x0, 0x80}, {}, {}, 0x0, 0x0, 0x0, 0x100}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r0, 0xc0bc5351, &(0x7f0000000380)={0x1, 0x1, 'client1\x00', 0x0, "54c2274d9f3ae6ff", "a7a5e94547b838c4df89588cfbf0df612d8b02afe9660ce9b1af9f674d637d47", 0x5c3, 0x1}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x28801, 0x0) write$FUSE_CREATE_OPEN(0xffffffffffffffff, 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x42280, 0x0) close(r4) ioctl$KVM_CHECK_EXTENSION(r5, 0xae01, 0x1) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r4, 0x4020aed2, &(0x7f0000000040)={0x0, 0x399000, 0x8}) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r4, 0x4020aed2, &(0x7f0000000080)={0x1000, 0x100000, 0x8}) 20m8.334431838s ago: executing program 5 (id=5811): r0 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$6lowpan_control(r0, &(0x7f0000000180)='connect aa:aa:aa:aa:aa:11 0', 0x1b) 20m8.225094201s ago: executing program 5 (id=5813): syz_emit_ethernet(0x3e, &(0x7f0000000040)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x41}, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x1, 0x31, 0x30, 0x68, 0x0, 0x9, 0x1, 0x0, @rand_addr=0x64010102, @local}, @time_exceeded={0xb, 0x1, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x4, 0x4, 0x68, 0x2, 0x9, 0x4, 0x81, @remote, @rand_addr=0x64010101}}}}}}, 0x0) (fail_nth: 1) 20m8.074023723s ago: executing program 5 (id=5814): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000100ffff000000000000000085000000230000009500"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='mm_khugepaged_scan_pmd\x00', r0}, 0x18) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000080)) ioctl$SNDCTL_DSP_CHANNELS(r1, 0xc0045006, &(0x7f0000000000)=0x2b) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f00000001c0)) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1200"], 0x48) r2 = syz_io_uring_setup(0x111, &(0x7f0000000140)={0x0, 0x334e, 0x10, 0x4, 0x312}, &(0x7f00000029c0)=0x0, &(0x7f0000000300)=0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_TEE={0x21, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, 0x7}) write$UHID_CREATE2(r5, &(0x7f00000001c0)=ANY=[@ANYBLOB="06"], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r5, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x101801, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0x2}) r7 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000100000000000000fe0018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021bc0000000c0a01010000000000000000070000000900020073797a31000000000900010073797a3000000000900003808c000080080003400000000280000b807c000180090001006c617374000000006c000280080001400000000508000140000000090c0002"], 0x140}}, 0x0) ioctl$TUNSETDEBUG(r6, 0x400454c9, 0xffffffffffffffff) ioctl$TUNSETLINK(r6, 0x400454cd, 0x110) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0, 0x60, 0x185100}) io_uring_enter(r2, 0x7277, 0x0, 0x28, 0x0, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) mkdir(&(0x7f0000000100)='./file0\x00', 0x4c) sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000003e000701feffffff00000000017c0000040042800c00018006000600800a0000200002801c00068018"], 0x44}, 0x1, 0x0, 0x0, 0x200440c4}, 0x0) 20m4.283643586s ago: executing program 5 (id=5821): openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0xb19bac1275610ac9) sched_setaffinity(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000500)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_KEY(r0, &(0x7f0000003180)={0x0, 0x0, &(0x7f0000003140)={&(0x7f0000000000)={0x24, r1, 0x1, 0x70bd25, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}]}, 0x24}}, 0x84) sched_setscheduler(0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) quotactl$Q_SYNC(0xffffffff80000101, 0x0, 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_SET(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)={0x3c, r5, 0x1, 0x0, 0x0, {0x2c}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x58}]}, 0x3c}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010126bd70eeffffff002b00000008000300", @ANYRES32=r8, @ANYBLOB="05003400c4000000080026006c0900000500240016000000"], 0x34}, 0x1, 0x0, 0x0, 0xd0}, 0x0) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/dev_mcast\x00') pread64(r9, &(0x7f0000033240)=""/102384, 0x18ff0, 0x41c) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x28801, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) close(r11) ioctl$KVM_CHECK_EXTENSION(r10, 0xae01, 0x1) 20m1.252680656s ago: executing program 2 (id=5831): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r4) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r7, {}, {0x2, 0xb}, {0xd, 0xfff3}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_MEMORY={0x8, 0xa, 0x5}]}}]}, 0x3c}}, 0x4008000) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 20m0.284150897s ago: executing program 5 (id=5834): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r0 = syz_clone(0x88200200, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x220) setpgid(0x0, r0) openat$dir(0xffffff9c, &(0x7f0000000240)='./file0\x00', 0x40, 0x1d0) execve(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) 20m0.253487144s ago: executing program 2 (id=5836): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000380)={0x0, 0x0, 0x10}, 0xc) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) syz_open_procfs(0x0, 0x0) socket$alg(0x26, 0x5, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='numa_maps\x00') pread64(r2, &(0x7f0000002180)=""/4101, 0x1005, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x4) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_PROTOCOL(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x2004090) sendto$inet6(r0, &(0x7f0000000180)="1a", 0x34000, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000080)="ab2c", 0x2}], 0x1) 19m59.572394507s ago: executing program 5 (id=5839): r0 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) r1 = syz_open_dev$vim2m(&(0x7f00000002c0), 0x2000000f5, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000240)={0xf0f03c, 0x2}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) bind$802154_dgram(r3, &(0x7f0000000140)={0x24, @short={0x2, 0x3, 0xaaa1}}, 0x14) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r4, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, 0x4, 0x6, 0x301, 0x0, 0x0, {0x1, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x40}}, 0x24000000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f00000004c0)={&(0x7f0000000480)=[0x0, 0x0], 0x2, 0x80800, 0x0, 0xffffffffffffffff}) r6 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r6, &(0x7f0000000040)={0x1d, r7, 0x8000000000000003, {}, 0x2}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x6, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa, 0x0, 0x8000000}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000700)='./file1\x00', 0x8000) r9 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000740), 0x4000, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000780)={{0x1, 0x1, 0x18, r3, {0xc057}}, './file0\x00'}) r11 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000007c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1, 0x4}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x11, 0xa, &(0x7f0000000500)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x80000000}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r5}}, @call={0x85, 0x0, 0x0, 0xbb}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}]}, &(0x7f0000000580)='syzkaller\x00', 0x401, 0x84, &(0x7f00000005c0)=""/132, 0x41000, 0x2, '\x00', r7, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000680)={0xa, 0x2}, 0x8, 0x10, &(0x7f00000006c0)={0x2, 0x6, 0x0, 0xa6}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000840)=[0xffffffffffffffff, r3, 0x1, 0xffffffffffffffff, 0x1, r8, r9, r10, r11]}, 0x94) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000180)={0x1, @pix={0x0, 0x1, 0x20493859, 0x0, 0x0, 0x0, 0x5, 0xfeedcafe, 0x3, 0x7, 0x0, 0x5}}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000280)={{0x1, 0x1, 0x18, r2, {0xffffffffffffffff, 0xee00}}, './file0\x00'}) newfstatat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x6000) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f00000003c0)=0x0) setresuid(r12, r13, r14) 19m59.127821242s ago: executing program 2 (id=5843): bpf$MAP_CREATE(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000480)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6a) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$SNDCTL_DSP_SETDUPLEX(0xffffffffffffffff, 0x5016, 0x0) r3 = fsopen(&(0x7f00000000c0)='nfsd\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) (fail_nth: 3) 19m57.73165878s ago: executing program 2 (id=5846): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000002c0)=0x659f, 0x4) write$binfmt_script(r1, &(0x7f00000000c0), 0x28) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) r3 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r3, 0x65, 0x2, 0x0, 0x0) sendmsg$ETHTOOL_MSG_RINGS_GET(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbdd2b8f4e89fe0a73154ff08ce185d7da27000fcdbdf250f0000001800018014000200"], 0x2c}, 0x1, 0x0, 0x0, 0x841}, 0x4894) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB="4c000440", @ANYRES16=r2, @ANYBLOB="100026bd7000ffdbdf251400000008000a0000400000080016000a000000080015000100000005000c00000000000800040008000000080002000c0000000500180001000000"], 0x4c}, 0x1, 0x0, 0x0, 0x14}, 0x84) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x808}}, './file0\x00'}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) dup(r0) getpid() sendmmsg$unix(r5, &(0x7f0000000880)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xffffffffffffffff}}}], 0x20, 0x8001}}], 0x1, 0x20000095) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x104000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file0\x00', 0x1c0) mount$bind(&(0x7f0000000300)='./file0\x00', &(0x7f0000000140)='./file0/file0\x00', 0x0, 0x1805406, 0x0) mount$fuse(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x80000, 0x0) unshare(0xc020600) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x2a05004, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$SG_IO(r4, 0x2285, &(0x7f0000000280)={0x53, 0xfffffffffffffffe, 0x44, 0x1, @buffer={0x0, 0x6a, &(0x7f0000000540)=""/106}, &(0x7f0000000180)="76532bc2d275a63e96069d566f0adf0f71a9c078c826ed879bddf92edb597d74a782fd01133e5038cd5539e327f2b998a5f62c5452e1b6f8f319872ee816fa25341f9d7a", &(0x7f0000000200)=""/91, 0x7ff, 0x10006, 0x0, &(0x7f0000000500)}) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_tcp_int(r6, 0x6, 0x6, &(0x7f00000000c0), &(0x7f0000000040)=0xfffffffffffffff6) r7 = socket(0x10, 0x3, 0x0) write(r7, &(0x7f0000000140)="2600000022004701050000070000000000000020002b1f000a4a51f1ee839cd53400b017ca5b", 0x26) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r7, 0x6, 0x21, &(0x7f0000000300)="2b5ca6e542a32400dd5522edeeee5c3f", 0x10) 19m57.672505263s ago: executing program 2 (id=5847): madvise(&(0x7f0000530000/0x2000)=nil, 0x2000, 0xe) syz_clone3(&(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x146b, 0x902, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) io_setup(0xd3, &(0x7f0000000000)) openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)={0x30, r3, 0x100, 0x70bd2c, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x1c}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}]}, 0x30}}, 0x0) r4 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000140)="1400000023000b6c8cfffdfccabb00f90429fc60", 0x14}], 0x1}, 0x2400c000) openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) eventfd2(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000340)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x6}}, './file0\x00'}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000000), 0x208e24b) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) r7 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x122c42) ioctl$LOOP_CONFIGURE(r7, 0x4c0a, &(0x7f0000001ac0)={r6, 0x0, {0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "24431a1e77a68e174f000000000000000010e200"}}) r8 = dup(r7) read$FUSE(r8, &(0x7f0000003c40)={0x2020}, 0xffffff0a) 19m56.239446217s ago: executing program 2 (id=5852): r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0xfe, 0x7ffc0002}]}) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="180100000100a7d9000000000020b200850000007b00000095"], &(0x7f0000000140)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xb904}, 0x94) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x8) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x14, &(0x7f00000000c0)={@mcast2, 0x0}, &(0x7f00000001c0)=0x14) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3deff000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r7 = syz_clone(0x102311, 0x0, 0x0, 0x0, 0x0, 0x0) r8 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000a40)=ANY=[@ANYRES16=r1, @ANYRESHEX=r0, @ANYRESHEX=r8, @ANYRESOCT, @ANYRES8=r5, @ANYRES32=r7, @ANYBLOB="a4a5b2f5fb6d6c54724b15d6c5190f6788a7854801e71e47499bcd5d69a7b7d3088d89e0f7dd316bc83c20acbb845b688da1b63e0116f9cd53044e1553ad0ba89fde6d9803c82b38696abeaaee6131e3b06517488c138f77139c05143c22598e3bcee0aaf98aa3f9c8397fc65254d6fa808370f34bd786cd7b", @ANYRESOCT=r6], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb70300000800"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r9, 0x0, 0xffffffffffffffd3) r10 = syz_open_procfs(0x0, &(0x7f0000000040)='net/igmp6\x00') ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000280)={r5, 0x7fffffff, 0x0, 0x10}) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1e000000aaa5000003000000aed80000810000", @ANYRES32=r11, @ANYBLOB="0500"/20, @ANYRES32=r4, @ANYRES32=r10, @ANYBLOB="0500e0ff01000000010000000200000069ee04fb850ad465f3aa1608"], 0x50) process_vm_writev(r7, &(0x7f0000000b40)=[{&(0x7f0000000480)=""/91, 0x5b}, {&(0x7f0000000500)=""/59, 0x3b}, {&(0x7f0000000580)}, {0x0}, {&(0x7f0000000c00)=""/162, 0xa2}, {&(0x7f0000000680)=""/197, 0xc5}, {&(0x7f0000000780)=""/220, 0xdc}, {&(0x7f0000000880)=""/152, 0x98}, {&(0x7f0000001a00)=""/131, 0x83}, {&(0x7f0000000940)=""/59, 0x3b}], 0xa, &(0x7f0000001e40), 0x0, 0x0) preadv(r10, &(0x7f0000000000), 0x0, 0x3ab3, 0x3) r12 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r12, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="38000000031401002abd7000fedbdf250900020073727a3100000000080041007369770014003300626f6e6430"], 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) kexec_load(0x0, 0x1, &(0x7f0000000140)=[{0x0, 0x0, 0x116094000, 0x200041000000}], 0x320000) 19m56.023489862s ago: executing program 34 (id=5852): r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0xfe, 0x7ffc0002}]}) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="180100000100a7d9000000000020b200850000007b00000095"], &(0x7f0000000140)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xb904}, 0x94) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x8) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x14, &(0x7f00000000c0)={@mcast2, 0x0}, &(0x7f00000001c0)=0x14) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3deff000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r7 = syz_clone(0x102311, 0x0, 0x0, 0x0, 0x0, 0x0) r8 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000a40)=ANY=[@ANYRES16=r1, @ANYRESHEX=r0, @ANYRESHEX=r8, @ANYRESOCT, @ANYRES8=r5, @ANYRES32=r7, @ANYBLOB="a4a5b2f5fb6d6c54724b15d6c5190f6788a7854801e71e47499bcd5d69a7b7d3088d89e0f7dd316bc83c20acbb845b688da1b63e0116f9cd53044e1553ad0ba89fde6d9803c82b38696abeaaee6131e3b06517488c138f77139c05143c22598e3bcee0aaf98aa3f9c8397fc65254d6fa808370f34bd786cd7b", @ANYRESOCT=r6], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb70300000800"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r9, 0x0, 0xffffffffffffffd3) r10 = syz_open_procfs(0x0, &(0x7f0000000040)='net/igmp6\x00') ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000280)={r5, 0x7fffffff, 0x0, 0x10}) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1e000000aaa5000003000000aed80000810000", @ANYRES32=r11, @ANYBLOB="0500"/20, @ANYRES32=r4, @ANYRES32=r10, @ANYBLOB="0500e0ff01000000010000000200000069ee04fb850ad465f3aa1608"], 0x50) process_vm_writev(r7, &(0x7f0000000b40)=[{&(0x7f0000000480)=""/91, 0x5b}, {&(0x7f0000000500)=""/59, 0x3b}, {&(0x7f0000000580)}, {0x0}, {&(0x7f0000000c00)=""/162, 0xa2}, {&(0x7f0000000680)=""/197, 0xc5}, {&(0x7f0000000780)=""/220, 0xdc}, {&(0x7f0000000880)=""/152, 0x98}, {&(0x7f0000001a00)=""/131, 0x83}, {&(0x7f0000000940)=""/59, 0x3b}], 0xa, &(0x7f0000001e40), 0x0, 0x0) preadv(r10, &(0x7f0000000000), 0x0, 0x3ab3, 0x3) r12 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r12, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="38000000031401002abd7000fedbdf250900020073727a3100000000080041007369770014003300626f6e6430"], 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) kexec_load(0x0, 0x1, &(0x7f0000000140)=[{0x0, 0x0, 0x116094000, 0x200041000000}], 0x320000) 19m44.405832287s ago: executing program 35 (id=5839): r0 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) r1 = syz_open_dev$vim2m(&(0x7f00000002c0), 0x2000000f5, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000240)={0xf0f03c, 0x2}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) bind$802154_dgram(r3, &(0x7f0000000140)={0x24, @short={0x2, 0x3, 0xaaa1}}, 0x14) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r4, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, 0x4, 0x6, 0x301, 0x0, 0x0, {0x1, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x40}}, 0x24000000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f00000004c0)={&(0x7f0000000480)=[0x0, 0x0], 0x2, 0x80800, 0x0, 0xffffffffffffffff}) r6 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r6, &(0x7f0000000040)={0x1d, r7, 0x8000000000000003, {}, 0x2}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x6, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa, 0x0, 0x8000000}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000700)='./file1\x00', 0x8000) r9 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000740), 0x4000, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000780)={{0x1, 0x1, 0x18, r3, {0xc057}}, './file0\x00'}) r11 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000007c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1, 0x4}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x11, 0xa, &(0x7f0000000500)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x80000000}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r5}}, @call={0x85, 0x0, 0x0, 0xbb}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}]}, &(0x7f0000000580)='syzkaller\x00', 0x401, 0x84, &(0x7f00000005c0)=""/132, 0x41000, 0x2, '\x00', r7, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000680)={0xa, 0x2}, 0x8, 0x10, &(0x7f00000006c0)={0x2, 0x6, 0x0, 0xa6}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000840)=[0xffffffffffffffff, r3, 0x1, 0xffffffffffffffff, 0x1, r8, r9, r10, r11]}, 0x94) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000180)={0x1, @pix={0x0, 0x1, 0x20493859, 0x0, 0x0, 0x0, 0x5, 0xfeedcafe, 0x3, 0x7, 0x0, 0x5}}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000280)={{0x1, 0x1, 0x18, r2, {0xffffffffffffffff, 0xee00}}, './file0\x00'}) newfstatat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x6000) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f00000003c0)=0x0) setresuid(r12, r13, r14) 10.030981776s ago: executing program 7 (id=9342): ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) close(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='memory.current\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000100), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000280)={0x4c, r1, 0x505, 0x0, 0x25dfdbfb, {0x3d}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd, 0x82}, {0x5, 0x87}}]}, 0x4c}}, 0x8) statx(r0, &(0x7f0000000180)='./file0\x00', 0x400, 0x80, &(0x7f0000000440)) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000080)={0x0}) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x1}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000140)={r3, 0x3, r4, 0x2}) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xb, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xfffffff7}, {{0x18, 0x1, 0x1, 0x0, r6}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0xffffff1f}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x6, 0x0, 0xd, 0x9, 0x0, 0x0, 0xffffff1f}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x7, 0x2}, {0x7, 0x0, 0x0, 0x8, 0x0, 0x0, 0xfffffdff}, {0x7, 0x1, 0xb, 0x4, 0x9}, {}, {0x4, 0x0, 0x6}, {0x18, 0x2, 0x2, 0x0, r6}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x5}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) 9.098303243s ago: executing program 6 (id=9345): r0 = socket$inet_sctp(0x2, 0x5, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0x10) connect$inet(r0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x0, @rand_addr=0x64010102}]}, &(0x7f0000000100)=0x10) connect$unix(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) keyctl$revoke(0x3, 0x0) r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_S_OUTPUT(r2, 0xc004562f, &(0x7f0000000000)=0x1) ioctl$VIDIOC_S_DV_TIMINGS(r2, 0xc0845657, &(0x7f0000000380)={0x0, @bt={0x2d0, 0x190, 0x1, 0x0, 0xdd9f83, 0x1, 0x9, 0x1, 0x2, 0x8, 0x722, 0xed, 0x7, 0x7f, 0x3f, 0xb763599953cb090f, {0x10000, 0x6fd8e84b}, 0x3, 0xed}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0x1b, &(0x7f0000000240)=ANY=[@ANYBLOB="180000006a0b0000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa10000000000000701000078ffffffb702000008000000b703000061000000850000000600000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7020000000000008500000086000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000200)='GPL\x00', 0x8, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r5, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, 0x0, 0x1, 0x70bd26, 0x23c, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}]}, 0x1c}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000180)='tlb_flush\x00', r4}, 0x10) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000940)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000006c000000160a01000000000000000000010000000900010073797a30000000000900020073797a300000000040000380080001400000000008000240000000002c0003801400010063616966300000000000000000000000140001006d6163766c616e3100000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c000380140001007465616d3000"], 0x110}}, 0x800) 8.255843215s ago: executing program 7 (id=9348): ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) close(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xb, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xfffffff7}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0xffffff1f}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x6, 0x0, 0xd, 0x9, 0x0, 0x0, 0xffffff1f}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x7, 0x2}, {0x7, 0x0, 0x0, 0x8, 0x0, 0x0, 0xfffffdff}, {0x7, 0x1, 0xb, 0x4, 0x9}, {}, {0x4, 0x0, 0x6}, {0x18, 0x2, 0x2, 0x0, r1}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x5}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) (fail_nth: 3) 7.896817738s ago: executing program 7 (id=9350): r0 = socket$inet_sctp(0x2, 0x5, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0x10) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e22, @local}, 0x10) socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x0, @rand_addr=0x64010102}]}, &(0x7f0000000100)=0x10) connect$unix(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) keyctl$revoke(0x3, 0x0) r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_S_OUTPUT(r2, 0xc004562f, &(0x7f0000000000)=0x1) ioctl$VIDIOC_S_DV_TIMINGS(r2, 0xc0845657, &(0x7f0000000380)={0x0, @bt={0x2d0, 0x190, 0x1, 0x0, 0xdd9f83, 0x1, 0x9, 0x1, 0x2, 0x8, 0x722, 0xed, 0x7, 0x7f, 0x3f, 0xb763599953cb090f, {0x10000, 0x6fd8e84b}, 0x3, 0xed}}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0x1b, &(0x7f0000000240)=ANY=[@ANYBLOB="180000006a0b0000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa10000000000000701000078ffffffb702000008000000b703000061000000850000000600000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7020000000000008500000086000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000200)='GPL\x00', 0x8, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) read$nci(r5, 0x0, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r6) ioctl$IOCTL_GET_NCIDEV_IDX(r5, 0x0, &(0x7f00000000c0)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000180)='tlb_flush\x00', r4}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r3, 0x0, 0xd}, 0x18) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000940)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000006c000000160a01000000000000000000010000000900010073797a30000000000900020073797a300000000040000380080001400000000008000240000000002c0003801400010063616966300000000000000000000000140001006d6163766c616e3100000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c000380140001007465616d3000"], 0x110}}, 0x800) 7.204207541s ago: executing program 6 (id=9352): r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00', 0x0, 0x42) open_by_handle_at(r0, &(0x7f0000000380)=ANY=[@ANYRES8=r0], 0x40000) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc04c565d, &(0x7f00000002c0)=@multiplanar_fd={0xc3b4eab, 0x7, 0x4, 0x400, 0x4, {0x0, 0xea60}, {0x2, 0x0, 0x7, 0xb, 0x4, 0x3, "f6de8be8"}, 0xac14, 0x4, {0x0}, 0x2}) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x8fff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x6, 0x88}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xfffffffffffffffe) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) read$nci(r2, 0x0, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCFLSH(r3, 0x80045438, 0x0) r4 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, &(0x7f0000000080)={'c6xdigio\x00', [0x3c4, 0x10, 0x2, 0xa, 0x14000000, 0x0, 0xfffffffc, 0x2, 0xffd, 0x7ffe, 0x3, 0x723, 0x400, 0x2, 0x13, 0x100, 0xffffffa7, 0x9, 0x34d, 0x1, 0x3ff, 0x9, 0x200, 0xe2df, 0xaa14, 0x1, 0x4, 0x0, 0x7, 0xf58, 0x6]}) ioctl$COMEDI_INSN(r4, 0x8028640c, &(0x7f0000000000)={0x4000000, 0x0, 0x0, 0x0, 0x80000000}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x7, 0x0, 0x0) write$nci(0xffffffffffffffff, &(0x7f0000001740)=@NCI_OP_CORE_INIT_RSP_V2={0x0, 0x1, 0x2, 0x1, 0x5, {0x1, 0xc, 0x3, 0x3, 0x4, 0x9, 0x5, 0x3, 0x6f, "bad45e265e96dc1ce36dac131b1126baa0c7c8a90c3a824b51746b39f2b0295b6999a3cee94bac3b6ad3a4472906319cbee76bb972143bf81dbf25e67a468298c2cd66ee042b490d38191a80eac4a0c3669195482e070fa2157afc927a66cf21fac07d1e662e320e134bd9cde6bc84"}}, 0x80) keyctl$read(0x2, 0x0, &(0x7f00000000c0)=""/4096, 0x1000) move_pages(0x0, 0x20a0, &(0x7f0000000040), &(0x7f0000001180), &(0x7f0000000000), 0x0) execve(&(0x7f0000000040)='./file0\x00', &(0x7f0000001900), &(0x7f0000000a80)={[&(0x7f00000018c0)='.^*%$\'-\\:\x00\xfb\x12#\x19\t\x99n\x1e\xef,NA\xf3)\xc8\xcd\x9bM\x83\x9d\v\x80\xcbU\xdcV\xe4\xff\xa8\xf1']}) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000180)={0xfb, 0x8, 0x0, "062383a78614d321eb086bebba55db0dfca05613826fffd4ee640ffed6cd68cb", 0x32314d54}) socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="e40000000201010800000000000000000a000000d00001800c000280050001000000000014000180080001000000000008000200000000002c00018014000300ff01000000000000000000000000000114000400ff0100000000000000000000000000010c00028005000100000000004700028005000100010000000600064000000000060005"], 0xe4}}, 0x0) 7.137895249s ago: executing program 3 (id=9353): syz_usb_disconnect(0xffffffffffffffff) (async) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000010d804dd000000000000010902240001000000"], 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async, rerun: 32) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) (rerun: 32) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) (async) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) (async) r2 = socket$inet(0xa, 0x801, 0x84) connect$inet(r2, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) (async, rerun: 64) listen(r2, 0xfffffffd) (async, rerun: 64) r3 = accept4(r2, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f0000001000), 0x581, 0x40000000, 0x0) (async) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000280)={0x3, 0x1, 0x2, 0x8c, 0xa4, 0x8, 0x1, 0x0, 0x5, 0x9, 0x0, 0x0, 0x2, 0x28}, 0xe) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x24, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 32) r4 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 32) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'bond0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@setlink={0x28, 0x13, 0x1, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, 0x41014, 0x54c1f}, [@IFLA_MASTER={0x8, 0xa, r5}]}, 0x28}}, 0x20000000) (async) mount$bpf(0x0, &(0x7f0000000100)='./cgroup\x00', &(0x7f0000000140), 0x10404, &(0x7f0000000580)={[{@gid}, {@gid}, {@mode={'mode', 0x3d, 0x1}}]}) 7.001264165s ago: executing program 8 (id=9354): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_LEAVE_GROUP(r0, 0x0, 0x2d, &(0x7f0000000380)={0x0, {{0x2, 0x4e21, @empty}}}, 0x88) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x800000000001001, 0xffffffffffffffff, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[], 0x50) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f000043b000/0x1000)=nil, 0xfffffffffffffdb5, &(0x7f0000000080)='\x00\xc9\xf5\x00\x00\x00\x00\x00\x00\x00+\x1ct\xc6\fr\xbaU\xc1\xb2\xd2\xde\xbfk\xc0\x18\x94\xc5&\xec\x03\xa0w\"E\xc9\xf2,K4\x10\xc8\x8cuj\xd3\xf0\xb3\xa9f\xf7\xb7\x17\xdf\xca\xac\x8b\x81K\t\x14^\xc3\xb7<\xa1\x15\v4\xd0\xbe\xa8\x01\x00<:-Y\n<\x1d\xb2\xe0kU\xc0\xc1\x14') mbind(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x8000, 0x0, 0x4c, 0x7) read$msr(r2, &(0x7f0000000440)=""/102392, 0x18ff8) ioctl$BTRFS_IOC_SCRUB(r1, 0xc400941b, 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYRESHEX=r2]) syz_open_procfs(0x0, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r3, 0x0, 0x30, 0x0, 0x90) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000240)='veth0_to_team\x00', 0x10) bpf$BPF_LINK_CREATE(0x1c, 0x0, 0xfffffffffffffe90) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) listen(r4, 0x0) accept4$rose(r4, 0x0, 0x0, 0x800) 6.951700802s ago: executing program 1 (id=9355): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x82403) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000800"], 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x11, 0x15, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000001000000000000000000010018110000", @ANYRES32=r3, @ANYBLOB, @ANYRES32=r2, @ANYBLOB], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) arch_prctl$ARCH_GET_GS(0x1004, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000001a40)=""/102392, 0x18ff8) epoll_create1(0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x2c, 0x1, 0x4, 0x101, 0x0, 0x0, {0x7, 0x0, 0x6}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}, @NFULA_CFG_NLBUFSIZ={0x8}, @NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0x80000001}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x4) (fail_nth: 2) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000140)='tlb_flush\x00', r4}, 0x18) ioctl$CEC_S_MODE(r1, 0x40046109, &(0x7f0000000080)=0xd0) close_range(r0, 0xffffffffffffffff, 0x0) r7 = syz_open_dev$usbmon(&(0x7f00000000c0), 0x7f, 0x105000) ioctl$MON_IOCX_MFETCH(r7, 0xc0109207, &(0x7f0000000140)={&(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xa, 0x4}) r8 = socket(0x1c, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r8, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x4d, &(0x7f0000000380)}, &(0x7f0000000180)=0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) setsockopt(r8, 0x84, 0xf5, &(0x7f0000000000)="f89fcfb587a4792b", 0x8) 6.877397382s ago: executing program 3 (id=9356): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x3, &(0x7f0000000000)=[{0x20, 0x0, 0x0, 0xfffff00c}, {0x20, 0x0, 0x0, 0xfffff00c}, {0x6}]}, 0x10) sendmmsg$inet(r0, &(0x7f0000002c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=ANY=[@ANYRESDEC=0x0], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8d}, 0x0) setxattr$incfs_metadata(&(0x7f0000000080)='./cgroup\x00', &(0x7f0000000280), 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000900)={0x18, 0x4, &(0x7f0000000c00)=ANY=[@ANYRESHEX], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r3}, 0x10) lsm_get_self_attr(0x66, &(0x7f0000000240)={0x0, 0x0, 0xab, 0x8b, ""/139}, &(0x7f0000000040)=0xab, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002000)=""/102400, 0x19000) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000380)=ANY=[@ANYRES8=r1, @ANYRES64=r2, @ANYRES32=r3, @ANYRES32=0x0, @ANYRES32, @ANYRESDEC=r0], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000003c0)={{r5, 0xffffffffffffffff}, &(0x7f0000000500), &(0x7f00000000c0)='%pS \x00'}, 0x20) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)=ANY=[@ANYRESOCT=r5], 0x4c}, 0x1, 0x0, 0x0, 0x4040000}, 0x800) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000009c0)=ANY=[@ANYBLOB="50000000090601020000000000000000030000000900020073797a31000000000500010007000000280007800c80116b1dac1414bb0c0002800800014064010101d30c294821d24366796a9c6870020d310bb6ea20836ddc444a5e8ee74835e0503de5d0f8ccc767117eb6e07c5df687d19458be9757802895cb2dc34b464fe46ef1a124c189c0c58d3dc4734fe0fd4614219f321e1ed9000f26c23da7e51d2398fe7ab14dbe435548a9e0a27bdde86c7b80109eb6d8d3f3db9e0700a526aa382e50288bcc3198b68f82a26a9278455cf8f36006f0bc92bdfd76568be157062d0f4de8bb9baf4f38c6d8ceb4cd0007eab8315bd2b6af954111b347b815267cc6aaf77c5f06bb499507aa1829924bbad78462516e250afdff1a9359831d187b4c885664e200"/307], 0x50}, 0x1, 0x0, 0x0, 0xd24f4d5778621d46}, 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000240)={r6}, 0x4) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000000040)={&(0x7f0000000780)="99ed8e46b4021007e5b5c3a84b8d7f8eaea7e693621d1a627ee15fdece70e9157ab620c78376058652b25c4041d49cd5c66f275d30086bfefe1bf3fdb0b12089feb090306947be5df3c03a35dddcac91b0b2dc70fcc6beb277446f352aef3ae500cb25524af2c3d461a4e05ac6cd2a8643cec5c41cf8d20a8d152180f3c49ef1b3e4943521f2173a0b66a44b82d731c9157dec177447edb4d35c114a2510267107d6fd38f72548a497141dd419fc2658f3aaefb3920d9b6e49ca7e485b794dfcc9f91e3a0dab684a44216e1d326d73d136760044fd8a2168f3e5e29cc909898ec421e25abe6edc834951064bb7992aa3b21548f55db1652ec2aa66446977ac614aa214afa09604d922fedd4db497d643cc259762c5f3433fa1ceea32e30164b8680b689b45076ad3325e62a26ed8ec641a721a489c880baaa395a35d0d73632435d88f6946d4f464b489abf6f986b19e44c31520b48b913d96", &(0x7f0000000700)=""/83, &(0x7f0000000600)="1807b198f06505475b67d1544026487a7d049c40b713d2a2ab30f5d2c96fb234e7df2de0721f9a0eeac5d467e204d8ac82e68ab485972000d6fbf3f93bb03e59a67626e29f36576a531f1e979573e8e804080dc68e2312d7e9468f40a8b5a4cd5d1a992d2e257d27ded871f928ff0ebca2bbf95b63a2f71b2d2ac25192985c74f909ee2f94867f9dbb7e5efe280b9efeb1ff2622e234a07fea167d8a6906c763750cb0b7ae2e2e8ad1b7feaf79f2f044ff23a59d040abb03f280403d29e3b69a26", &(0x7f0000000400)="c9e14e4abdfeb5e71ad623e84919ed528d34b06fce16d7e0146f211e69364d", 0x4, r2, 0x4}, 0x38) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0x11, &(0x7f0000000540)=ANY=[@ANYBLOB="180200000000000000000000030000008500000017000000b7080000000000007b8af8ff00000000b7080000000000807b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffe16}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r9, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc09b6f2609", 0x0, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket(0x2, 0x80805, 0x0) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) prctl$PR_CAP_AMBIENT(0x2f, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r10, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) read$FUSE(0xffffffffffffffff, &(0x7f0000002080)={0x2020}, 0x2020) 6.164192766s ago: executing program 1 (id=9357): syz_emit_ethernet(0x66, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket(0x2, 0x80805, 0x0) getsockopt$SO_COOKIE(0xffffffffffffffff, 0x1, 0x4a, 0x0, &(0x7f0000000400)) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0c0000000400000004000000070000000000", @ANYRES32, @ANYBLOB='\x00'/10, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000f6ffffffff010000000000003a229b67ee937cd281fff32fd5d2bd94b84f22144b0339f626f14da27783c057502c14d3aebeb6ead67ff52b74442367e5b946d088c89d178755d14e7d9fc9e2af54aa03a9c9e0c8830cfb15c769db57a0d3be6250b5f926d755b1c08103b68df0f69087edd5936b20143c2cf94627ed53875d"], 0x50) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r3, 0x3ba0, &(0x7f0000000400)={0x48, 0x2, r4, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000180)={0x28, 0x2, r4, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x100000000}) ioctl$IOMMU_HWPT_ALLOC$NONE(r3, 0x3b89, &(0x7f0000000000)={0x28, 0x2, r5, r4, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_UNMAP$ALL(r3, 0x3b86, &(0x7f0000000040)={0x18, r4}) bpf$BPF_GET_MAP_INFO(0x3, &(0x7f0000000140)={r2, 0x58, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000100)={'veth1_vlan\x00', &(0x7f0000000240)=@ethtool_gstrings={0x1b, 0x6, 0x8, "f4e56214886a8213"}}) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1e0000000200000006000000080000", @ANYRES32, @ANYBLOB="0b000002000000000000000000000000bcbb0000", @ANYRES32=r6, @ANYRES32, @ANYBLOB="0100000001000000040000000900"/28], 0x50) syz_open_dev$tty1(0xc, 0x4, 0x1) statfs(&(0x7f0000000280)='./file0\x00', &(0x7f0000000300)=""/49) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) 6.018704333s ago: executing program 7 (id=9358): ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000040)={0xc}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_io_uring_setup(0x110, &(0x7f00000000c0)={0x0, 0x1b00, 0x0, 0x3, 0x80}, &(0x7f0000000180)=0x0, &(0x7f0000000280)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000400), 0x9) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c000000020603000000000000000000ffea000005000100070000000900020073797a300000000014000780080012401b0000000800084000000000050005000000001005000400000000000d000300686173683a6d6163"], 0x5c}}, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000000c0)=0xf) pipe2$9p(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d0ff0f1d0dbd30", 0x10) r8 = accept4(r7, 0x0, 0x0, 0x0) recvmmsg(r8, &(0x7f00000001c0)=[{{0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f00000005c0)=""/34, 0x22}, {&(0x7f00000006c0)=""/188, 0xbc}], 0x2}, 0x7}], 0x1, 0x10000, 0x0) sendmsg$nl_route_sched_retired(r8, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000001780)=@newtfilter={0xf8, 0x2c, 0x800, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xffeb, 0xf}, {0xfff1, 0x2}, {0xfff2, 0xffe0}}, [@f_tcindex={{0xc}, {0xc8, 0x2, [@TCA_TCINDEX_ACT={0xc4, 0x7, [@m_mirred={0x70, 0x1f, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x101, 0x8, 0x1, 0x5, 0x8}, 0x4}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x9, 0x0, 0x1, 0x3, 0xff}, 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x3}}}}, @m_tunnel_key={0x50, 0x10, 0x0, 0x0, {{0xf}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0x5, @private1}, @TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x4, @loopback}]}, {0x4}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0xf8}, 0x1, 0x0, 0x0, 0xc4}, 0x40) write$P9_RGETLOCK(r6, &(0x7f0000000440)=ANY=[], 0x1f) r9 = fcntl$dupfd(r5, 0x0, r5) ioctl$TCFLSH(r9, 0x400455c8, 0x2) ioctl$TIOCSETD(r9, 0x5412, &(0x7f0000000140)=0xffffffc0) ioctl$TIOCSTI(r9, 0x5412, &(0x7f0000000040)=0xfc) 5.651514067s ago: executing program 3 (id=9359): openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) syz_io_uring_setup(0x10e, &(0x7f00000000c0)={0x0, 0x8d2dc, 0x0, 0xffffffff}, &(0x7f00000003c0), &(0x7f0000000140)) socket(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) mount(0x0, &(0x7f0000000240)='.\x00', &(0x7f00000000c0)='nfs\x00', 0x0, &(0x7f0000000280)='\x02\x00\x00\x00\x04\xb0\xfe\x98\x9a!s\x91]\xab\xc9\xa2IV\xb6-\xbfS\x16 \x04\r\xcd\xdb\x9a\xd4\xaf\r\x11\xa0\xd7\xd7\xb6\x9bz\x99\xaf\xfd\x87fN\xad\x90U\xb4A\xdf\xabB\xbba\x7f\xb8\x96\x1a\xe7\xc1\xab\x16\x02\x00\xfaC\x93\xc0S\xaf\f\x1a\fEik\x86\x15\xab\x909\xf8i\xc0\xa7\xa9\xb1\xbe\xc7\x1d\xe0\x18\xd2\xbaG|\xd5fC\x8d\t\x00/I\x8b\xbf\x94\xf4\x96[us\x96\x90\x8d\x9d\xfb\xdc\x7f0&\xab\x17@)\xf1\xc3Q\xb2M :\xaa\x99G\xdd\xa9E6A]@>\f\xb1n\x1a\x8c\xc6e7{@\x90\x8fz\xfcf\x88\x15A\x0e\xbf\xb8\xff\xa8\xb9\xab\x83>\xf9I0\xdd\x93#\x1e\x00\xed#\xc9\xd0Uk\xa6b\xa6/\x15\x92\xc6,p\xc9\xce\xe1\xc3\xd5\x89Lw\x17\x16\x18\xddh\xc8\x81w\x1e\x7f\xc7\x16\xe5\x96\x03\t\xc3\x94\xc7\xeb\xd6.\xfa\xb3\xe0\x1f\xa9\x19\xfaS\x1f[T\x1e\xc5nX\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00=0\xc3\xbc\xfd\xce~\xe3\xcaO\"\xbb\xd1\x15\xf2y\xb91\x1d\xab\xeaO\x19\rH4\xc2\xe4\x922~K^K`55\xb7\xd1\n\xba\xb7,\xdb\xc2\x86\xc30bnc\x06\x06q\xe9\x97\fHA<\x94`\xf7H?\x86\xb8C9\b\x18vFWRdNee\xf1A\x06\x8f\x97\x99\xa5A\xfa\x94IfB\xa9\xf5\xd8\x83\xc5\b\x0eL\\Z\x80](f6D\x1a\xf7si\xa4l\xa8\x0f\xcc\xa1\xef\x1bCq\x0e\xf87\xfc\xce\x96cm\x83\x05S\x01Zj`dP:d\xba\x02\x14\xaa\x051\xd7\x87\x1b\xcb\xa2.\x89\x16CRx\x9b\x04\x1f\x8fA\t<\x99/\'tk\xcb\xd7|\x0f\xc9m\x95\x9a\n\v&\xca\xcd\x11\xec\xfd\x17a$.\xe9\x14\x8f\n\x15\x8d\rJ\x99\x8a\x87\x81\xc4S\x85L\xe5w\xa1\xbf\x91Q&6\x8e\xd1\x02\x19K\xd3\xab\xe5\xdc\xac\x05\x8dQ\xf4\x1aa\x86\xbc6\\\x06\xdf\x84\x00+F|\xa6\xc4\xab\x00G\xd0\x14N+\xf9\x84i?C\x81\x8eu\xd3\xcbg\xb7\a\xd9\x9a*\x17>\xac\x9d\x9d\xf6\t\xd8b\x19\x8a\x1e&\xde\x87-%\xf3\x8a2L\x1cQ2\f\x94\xf7\xf9\xadI\xedU\xabr\xe2\xe1\xc2{\b\xa8\xc2\n4\x0f\'\xed\xcc\xd7qG\xa7p\x8ct\xe3/l\v\x93\x8a\x95R\xd6\x19L\x85\x80\x18\x15\xcezn\xa8,i\xf1\x91@\xc0\xb1\a\xfd\xec\x95>\b(\xfa~O\xfd\xe2\a6b\x97\xc6$?;\x8eJ/P\x9d\x17\xaaU\xc4\b') syz_io_uring_setup(0x49c, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x7fff, 0x0, 0x1}}, 0x40) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000240)=r2) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000040)={0x1, r2}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/246, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/70, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0x73, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000000)=0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000f}, 0x94) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="b80000001300e9990000"], 0xb8}, 0x1, 0x0, 0x0, 0x1158e3b975e78980}, 0x0) ioctl$MON_IOCX_GET(0xffffffffffffffff, 0x40189206, 0x0) 5.266412019s ago: executing program 1 (id=9360): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x3, 0x13, &(0x7f00000001c0)=ANY=[@ANYBLOB="18020000867700000000000000000000180100002025702500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b703000004000000850000000600000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007b00000095"], 0x0, 0x5, 0x0, 0x0, 0x41000, 0xc}, 0x94) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x13, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002420702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000228500000094"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r0, 0x0, 0xfffffffffffffd5f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) msgget(0x0, 0x40) msgget(0x2, 0x1) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000)={0x1, 0x0, 0x56b, 0xfffffffffffffffc}) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0x3, 0x6576, 0xd}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x3, 0x6576, 0xd, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r4}) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x2, 0x2, 0x1, 0x7}) bpf$PROG_LOAD(0x5, 0x0, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) prctl$PR_CAPBSET_DROP(0x18, 0x10) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000240)=0x1) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000380)={0x6, 0x1, 0x0, "eee98fa706178749cb4dfd93e33c9b6b7bd152f35ed734fc70157dcb4f1891e2", 0x43353039}) syz_clone(0x62000000, 0x0, 0x0, 0x0, 0x0, 0x0) lsm_set_self_attr(0x0, 0x0, 0x3e, 0x0) 5.066259286s ago: executing program 8 (id=9361): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00'}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={0x0}}, 0x44080) mount$tmpfs(0x0, 0x0, &(0x7f00000001c0), 0x80, &(0x7f0000000080)={[{@quota}, {@usrquota_block_hardlimit={'usrquota_block_hardlimit', 0x3d, [0x38]}}]}) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') semop(0x0, &(0x7f00000001c0)=[{0x1, 0xbbdd, 0x1000}], 0x1) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000140)=[0x6, 0x7fff]) read$FUSE(r3, &(0x7f0000003480)={0x2020}, 0x2020) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r4, &(0x7f0000000000)="3b000000010006", 0x7) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'lo\x00'}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x1c, 0x0, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847e088641100050000210283ac14", 0x0, 0x11, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x50) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000009c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x8000000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20080, 0x1c4fb}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) socket$nl_route(0x10, 0x3, 0x0) 4.495772801s ago: executing program 7 (id=9362): syslog(0x2, &(0x7f0000001740), 0x0) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x20000000}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x8, 0x800000, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) move_pages(0x0, 0x0, 0x0, &(0x7f0000000740)=[0x0, 0x40, 0x7], &(0x7f0000000780), 0x2) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000001040)={'gre0\x00', &(0x7f0000000100)={'syztnl2\x00', 0x0, 0x2f00, 0x0, 0x0, 0x2000006, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x2f, 0x0, @broadcast, @multicast1}}}}) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000100)={0x0, 0x3ffc, 0x0, 0x1, 0x35, "ffff00"}) syz_open_pts(0xffffffffffffffff, 0x0) ioctl$SIOCX25GDTEFACILITIES(0xffffffffffffffff, 0x89ea, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=ANY=[@ANYBLOB="740100001b00030825bd7000fedbdf25ac141422000000000000000000000000200100000000000000000000000000014e2100004e2300000a004b202b000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0400000000000000030000000000000004000000000000000002000000000000763f0000000000000500000000000000360100000000000002000000000000000300000000000000090000000000000009000000000000008265000000000000feffffffb66b6e0001010001000000000600000000000000080018000000000010000a0025bd70002abd7000400000002400090007000000000000007f00000000000000ca03000000000000080000000000000008001f"], 0x174}}, 0x0) io_setup(0x7, &(0x7f0000000000)) syz_open_dev$ttys(0xc, 0x2, 0x0) r4 = open(&(0x7f0000000040)='./bus\x00', 0x4e142, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r2, 0x0, 0x488, &(0x7f0000000180)={{0x21, @empty, 0x4e23, 0x1, 'lblcr\x00', 0x4, 0xffffffff, 0xb}, {@multicast1, 0x4e22, 0x1, 0x4, 0x10000005, 0x8}}, 0x44) syz_usb_connect(0x0, 0x24, &(0x7f0000000380)=ANY=[@ANYBLOB="120100004b41460860163209ea800102030109021e0001000000000904"], 0x0) r6 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r6, 0x707, &(0x7f0000000200)={&(0x7f0000000140)=[{0x63, 0x200, 0x0, 0x0}], 0x1}) ioctl$COMEDI_INSN(0xffffffffffffffff, 0x8028640c, &(0x7f0000000000)={0x4000000, 0x0, 0x0, 0x8001, 0x4}) ioctl$BLKZEROOUT(r5, 0x127f, &(0x7f0000000240)={0x0, 0x1000000}) pwritev2(r4, &(0x7f0000000680), 0x0, 0x6000000, 0x0, 0x0) 3.914566983s ago: executing program 6 (id=9363): syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) migrate_pages(0x0, 0x4, &(0x7f00000002c0)=0x7f, &(0x7f0000000300)=0xa) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) writev(r0, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2) r1 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) syz_clone(0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_init_net_socket$ax25(0x3, 0x5, 0xcb) r3 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) pread64(r3, 0x0, 0x0, 0xa) ioctl$VIDIOC_S_INPUT(r3, 0xc0045627, &(0x7f0000000280)=0x2) r4 = memfd_secret(0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x80, 0x7ffc1ffd}]}) futimesat(r4, 0x0, 0x0) connect$ax25(r2, &(0x7f00000001c0)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x5}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast]}, 0x48) mlock2(&(0x7f0000018000/0x2000)=nil, 0x2000, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) 3.826196726s ago: executing program 8 (id=9364): r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) r2 = creat(&(0x7f0000000000)='./file0\x00', 0xd931d3864d39ddd8) write$tun(r2, &(0x7f0000000280)=ANY=[@ANYBLOB="000088090203fcfb"], 0x11) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000a00)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', r1, 0x0, 0x0, 0x5}, 0x50) 3.73054524s ago: executing program 8 (id=9365): r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00', 0x0, 0x42) open_by_handle_at(r0, &(0x7f0000000380)=ANY=[@ANYRES8=r0], 0x40000) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc04c565d, &(0x7f00000002c0)=@multiplanar_fd={0xc3b4eab, 0x7, 0x4, 0x400, 0x4, {0x0, 0xea60}, {0x2, 0x0, 0x7, 0xb, 0x4, 0x3, "f6de8be8"}, 0xac14, 0x4, {0x0}, 0x2}) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x8fff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x6, 0x88}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xfffffffffffffffe) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) read$nci(r2, 0x0, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCFLSH(r3, 0x80045438, 0x0) r4 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, &(0x7f0000000080)={'c6xdigio\x00', [0x3c4, 0x10, 0x2, 0xa, 0x14000000, 0x0, 0xfffffffc, 0x2, 0xffd, 0x7ffe, 0x3, 0x723, 0x400, 0x2, 0x13, 0x100, 0xffffffa7, 0x9, 0x34d, 0x1, 0x3ff, 0x9, 0x200, 0xe2df, 0xaa14, 0x1, 0x4, 0x0, 0x7, 0xf58, 0x6]}) ioctl$COMEDI_INSN(r4, 0x8028640c, &(0x7f0000000000)={0x4000000, 0x0, 0x0, 0x0, 0x80000000}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x7, 0x0, 0x0) ioctl$UI_ABS_SETUP(r2, 0x401c5504, &(0x7f0000000340)={0x4, {0x966, 0x1, 0x3, 0x9, 0x0, 0x4}}) write$nci(0xffffffffffffffff, &(0x7f0000001740)=@NCI_OP_CORE_INIT_RSP_V2={0x0, 0x1, 0x2, 0x1, 0x5, {0x1, 0xc, 0x3, 0x3, 0x4, 0x9, 0x5, 0x3, 0x72, "bad45e265e96dc1ce36dac131b1126baa0c7c8a90c3a824b51746b39f2b0295b6999a3cee94bac3b6ad3a4472906319cbee76bb972143bf81dbf25e67a468298c2cd66ee042b490d38191a80eac4a0c3669195482e070fa2157afc927a66cf21fac07d1e662e320e134bd9cde6bc84789344"}}, 0x83) keyctl$read(0x2, 0x0, &(0x7f00000000c0)=""/4096, 0x1000) move_pages(0x0, 0x20a0, &(0x7f0000000040), &(0x7f0000001180), &(0x7f0000000000), 0x0) execve(&(0x7f0000000040)='./file0\x00', &(0x7f0000001900), &(0x7f0000000a80)={[&(0x7f00000018c0)='.^*%$\'-\\:\x00\xfb\x12#\x19\t\x99n\x1e\xef,NA\xf3)\xc8\xcd\x9bM\x83\x9d\v\x80\xcbU\xdcV\xe4\xff\xa8\xf1']}) openat$sndseq(0xffffffffffffff9c, 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000180)={0xfb, 0x8, 0x0, "062383a78614d321eb086bebba55db0dfca05613826fffd4ee640ffed6cd68cb", 0x32314d54}) socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="e40000000201010800000000000000000a000000d00001800c000280050001000000000014000180080001000000000008000200000000002c00018014000300ff01000000000000000000000000000114000400ff0100000000000000000000000000010c00028005000100000000004700028005000100010000000600064000000000060005"], 0xe4}}, 0x0) 3.656493805s ago: executing program 3 (id=9366): write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) close(0xffffffffffffffff) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) getrandom(&(0x7f0000000040)=""/133, 0xfffffffffffffdde, 0x2) (fail_nth: 3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) epoll_pwait(0xffffffffffffffff, 0x0, 0x0, 0x5040100, 0x0, 0x32) pipe2(0x0, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, 0x0, 0x0) sendmsg$ETHTOOL_MSG_RINGS_GET(0xffffffffffffffff, 0x0, 0x4894) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f00000000c0), 0x40880, 0x0) ioctl$SOUND_MIXER_READ_RECSRC(r1, 0x80044dff, &(0x7f0000000200)) 3.598011361s ago: executing program 6 (id=9367): ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) socket$inet(0x2, 0x80000, 0xfffffffd) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e1f, @local}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x10a) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xb, 0x0, 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mkdir(&(0x7f0000000040)='./file1\x00', 0x148) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000340)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@xino_on}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(0x0) r4 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x4) getdents(r4, &(0x7f0000001fc0)=""/184, 0x20002078) 2.369484141s ago: executing program 6 (id=9368): r0 = socket$inet_sctp(0x2, 0x5, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0x10) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e22, @local}, 0x10) socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x0, @rand_addr=0x64010102}]}, &(0x7f0000000100)=0x10) connect$unix(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) keyctl$revoke(0x3, 0x0) r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_S_OUTPUT(r2, 0xc004562f, &(0x7f0000000000)=0x1) ioctl$VIDIOC_S_DV_TIMINGS(r2, 0xc0845657, &(0x7f0000000380)={0x0, @bt={0x2d0, 0x190, 0x1, 0x0, 0xdd9f83, 0x1, 0x9, 0x1, 0x2, 0x8, 0x722, 0xed, 0x7, 0x7f, 0x3f, 0xb763599953cb090f, {0x10000, 0x6fd8e84b}, 0x3, 0xed}}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0x1b, &(0x7f0000000240)=ANY=[@ANYBLOB="180000006a0b0000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa10000000000000701000078ffffffb702000008000000b703000061000000850000000600000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7020000000000008500000086000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000200)='GPL\x00', 0x8, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) read$nci(r5, 0x0, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r6) ioctl$IOCTL_GET_NCIDEV_IDX(r5, 0x0, &(0x7f00000000c0)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000180)='tlb_flush\x00', r4}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r3, 0x0, 0xd}, 0x18) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000940)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000006c000000160a01000000000000000000010000000900010073797a30000000000900020073797a300000000040000380080001400000000008000240000000002c0003801400010063616966300000000000000000000000140001006d6163766c616e3100000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c000380140001007465616d3000"], 0x110}}, 0x800) 2.203337739s ago: executing program 1 (id=9369): openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000380)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000640)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) r2 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000300)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x318, 0x1, 0x24}, 0x9c) 2.127669686s ago: executing program 3 (id=9370): write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000001040)={0xf, {"a2e3ad21ed0d09f91b3d090987f70e06d038e7ff7fc6e5539b0d480e8b089b3f350068090890e0878f0e1ac6e7049b336d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d076d0936cd3b78130daa61d8e8040000005802b77f07227227b7fa67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e9871540000000000004ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e4843e2808d4743b95bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c6f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20e8911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab9d6203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edcad74b221cfec48000000000000000d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea50000000000000068987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c10900df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d8008d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c46bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78bb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bf340b17cfcfd9c52c9711937f79abb1a124f121fc65483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4f01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8650000878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95a498b562d71565f924779ca1f731b3346ff177050373d79ff7bc1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f79a598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015a08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b686081b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24ae918423922e4e0167584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f13a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307f561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0xfffffffffffffe40}}, 0x1047) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) pipe(&(0x7f00000001c0)) r0 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f00000000c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) gettid() bind$inet(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x114) mount$fuse(0x0, 0x0, 0x0, 0x8, &(0x7f0000000040)=ANY=[@ANYBLOB='fd=', @ANYRESDEC=0x0]) mount(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000280)='autofs\x00', 0x201000c, &(0x7f0000000040)) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x4b800, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r2, 0xc018937e, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) r4 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_int(r4, 0x101, 0x3, 0x0, 0x0) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000000)={0x84, @rand_addr=0x64010102, 0x4e20, 0x3, 'wrr\x00', 0x10, 0x2, 0x6e}, 0x2c) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x20000000000014, 0x0, 0x106, 0x4}}, 0x20) setsockopt$IP_VS_SO_SET_FLUSH(r3, 0x0, 0x485, 0x0, 0x0) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, 0x0) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r6, 0x0, 0x1, &(0x7f00000030c0)=0x1000000, 0x4) mlock(&(0x7f000016b000/0x2000)=nil, 0x2000) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) 1.951133559s ago: executing program 8 (id=9371): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = socket(0x2, 0x80805, 0x0) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0c0000000400000004000000070000000000", @ANYRES32, @ANYBLOB='\x00'/10, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000f6ffffffff010000000000003a229b67ee937cd281fff32fd5d2bd94b84f22144b0339f626f14da27783c057502c14d3aebeb6ead67ff52b74442367e5b946d088c89d178755d14e7d9fc9e2af54aa03a9c9e0c8830cfb15c769db57a0d3be6250b5f926d755b1c08103b68df0f69087edd5936b20143c2cf94627ed53875d"], 0x50) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r5, 0x3b89, &(0x7f0000000000)={0x28, 0x2, 0x0, r6, 0x0, 0x0, 0x0, 0x0, 0x0}) bpf$BPF_GET_MAP_INFO(0x3, &(0x7f0000000140)={r4, 0x58, &(0x7f00000000c0)}, 0x10) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000100)={'veth1_vlan\x00', &(0x7f0000000240)=@ethtool_gstrings={0x1b, 0x6, 0x8, "f4e56214886a8213"}}) 1.189708364s ago: executing program 1 (id=9372): ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) socket$inet(0x2, 0x80000, 0xfffffffd) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e1f, @local}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x10a) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xb, 0x0, 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mkdir(&(0x7f0000000040)='./file1\x00', 0x148) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000340)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@xino_on}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') r4 = open(0x0, 0x0, 0x4) getdents(r4, &(0x7f0000001fc0)=""/184, 0x20002078) 1.141826428s ago: executing program 3 (id=9373): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x169802, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_BIND_MAP(0x23, 0x0, 0x0) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r4 = socket$kcm(0x2, 0x200000000000001, 0x0) socket$inet(0x2, 0x3, 0x6) sendmsg$inet(r4, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c085) sendmsg$inet(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000240)="0acca76cc06f351a2918d9c58db7444dfa", 0x11}], 0x1, 0x0, 0x0, 0x10000000}, 0x52cc) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xf}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x9}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x78}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x6}]}, @NFT_MSG_NEWSETELEM={0x44, 0x1e, 0xa, 0x105, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x10, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xa, 0x1, "fefe807eb37b"}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xc8}}, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000400000000000000000000008500000041000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007b00000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r7, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000480)="9e99c53773cc9fa4c38d37034a86", 0x0, 0x2000, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000000080)={@empty}, &(0x7f00000000c0)=0x14) ioprio_set$pid(0x2, 0x0, 0x0) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r8, r8, 0x0, 0x20003f) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x5c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0x5}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x1}, @NFTA_EXTHDR_TYPE={0x5}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x84}}, 0x0) ioctl$BLKBSZSET(r0, 0x40081271, &(0x7f0000000100)=0x10000) read(r0, &(0x7f00000004c0)=""/241, 0xf1) 1.139524375s ago: executing program 7 (id=9374): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00'}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={0x0}}, 0x44080) mount$tmpfs(0x0, 0x0, &(0x7f00000001c0), 0x80, &(0x7f0000000080)={[{@quota}, {@usrquota_block_hardlimit={'usrquota_block_hardlimit', 0x3d, [0x38]}}]}) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') semop(0x0, &(0x7f00000001c0)=[{0x1, 0xbbdd, 0x1000}], 0x1) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000140)=[0x6, 0x7fff]) read$FUSE(r3, &(0x7f0000003480)={0x2020}, 0x2020) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r4, &(0x7f0000000000)="3b000000010006", 0x7) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'lo\x00'}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x1c, 0x0, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847e088641100050000210283ac14", 0x0, 0x11, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x50) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000009c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x8000000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20080, 0x1c4fb}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) socket$nl_route(0x10, 0x3, 0x0) 596.909215ms ago: executing program 8 (id=9375): r0 = open(&(0x7f0000000000)='./file0\x00', 0x4080, 0x1) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETCRTC(0xffffffffffffffff, 0xc06864a1, &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f00000001c0)={0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000080)={0x0, 0x0, r2, 0x0, 0x0, 0x1, &(0x7f0000000040)=[0x0]}) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_pidfd_open(r3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x38, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x88adfda5}, [@IFLA_LINKINFO={0x10, 0x12, 0x0, 0x1, @hsr={{0x8}, {0x4}}}, @IFLA_MTU={0x8, 0x4, 0xffe1}]}, 0x38}}, 0x0) setns(r4, 0x10000000) 25.463449ms ago: executing program 1 (id=9376): openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) syz_io_uring_setup(0x10e, &(0x7f00000000c0)={0x0, 0x8d2dc, 0x0, 0xffffffff}, &(0x7f00000003c0), &(0x7f0000000140)) socket(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) mount(0x0, &(0x7f0000000240)='.\x00', &(0x7f00000000c0)='nfs\x00', 0x0, &(0x7f0000000280)='\x02\x00\x00\x00\x04\xb0\xfe\x98\x9a!s\x91]\xab\xc9\xa2IV\xb6-\xbfS\x16 \x04\r\xcd\xdb\x9a\xd4\xaf\r\x11\xa0\xd7\xd7\xb6\x9bz\x99\xaf\xfd\x87fN\xad\x90U\xb4A\xdf\xabB\xbba\x7f\xb8\x96\x1a\xe7\xc1\xab\x16\x02\x00\xfaC\x93\xc0S\xaf\f\x1a\fEik\x86\x15\xab\x909\xf8i\xc0\xa7\xa9\xb1\xbe\xc7\x1d\xe0\x18\xd2\xbaG|\xd5fC\x8d\t\x00/I\x8b\xbf\x94\xf4\x96[us\x96\x90\x8d\x9d\xfb\xdc\x7f0&\xab\x17@)\xf1\xc3Q\xb2M :\xaa\x99G\xdd\xa9E6A]@>\f\xb1n\x1a\x8c\xc6e7{@\x90\x8fz\xfcf\x88\x15A\x0e\xbf\xb8\xff\xa8\xb9\xab\x83>\xf9I0\xdd\x93#\x1e\x00\xed#\xc9\xd0Uk\xa6b\xa6/\x15\x92\xc6,p\xc9\xce\xe1\xc3\xd5\x89Lw\x17\x16\x18\xddh\xc8\x81w\x1e\x7f\xc7\x16\xe5\x96\x03\t\xc3\x94\xc7\xeb\xd6.\xfa\xb3\xe0\x1f\xa9\x19\xfaS\x1f[T\x1e\xc5nX\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00=0\xc3\xbc\xfd\xce~\xe3\xcaO\"\xbb\xd1\x15\xf2y\xb91\x1d\xab\xeaO\x19\rH4\xc2\xe4\x922~K^K`55\xb7\xd1\n\xba\xb7,\xdb\xc2\x86\xc30bnc\x06\x06q\xe9\x97\fHA<\x94`\xf7H?\x86\xb8C9\b\x18vFWRdNee\xf1A\x06\x8f\x97\x99\xa5A\xfa\x94IfB\xa9\xf5\xd8\x83\xc5\b\x0eL\\Z\x80](f6D\x1a\xf7si\xa4l\xa8\x0f\xcc\xa1\xef\x1bCq\x0e\xf87\xfc\xce\x96cm\x83\x05S\x01Zj`dP:d\xba\x02\x14\xaa\x051\xd7\x87\x1b\xcb\xa2.\x89\x16CRx\x9b\x04\x1f\x8fA\t<\x99/\'tk\xcb\xd7|\x0f\xc9m\x95\x9a\n\v&\xca\xcd\x11\xec\xfd\x17a$.\xe9\x14\x8f\n\x15\x8d\rJ\x99\x8a\x87\x81\xc4S\x85L\xe5w\xa1\xbf\x91Q&6\x8e\xd1\x02\x19K\xd3\xab\xe5\xdc\xac\x05\x8dQ\xf4\x1aa\x86\xbc6\\\x06\xdf\x84\x00+F|\xa6\xc4\xab\x00G\xd0\x14N+\xf9\x84i?C\x81\x8eu\xd3\xcbg\xb7\a\xd9\x9a*\x17>\xac\x9d\x9d\xf6\t\xd8b\x19\x8a\x1e&\xde\x87-%\xf3\x8a2L\x1cQ2\f\x94\xf7\xf9\xadI\xedU\xabr\xe2\xe1\xc2{\b\xa8\xc2\n4\x0f\'\xed\xcc\xd7qG\xa7p\x8ct\xe3/l\v\x93\x8a\x95R\xd6\x19L\x85\x80\x18\x15\xcezn\xa8,i\xf1\x91@\xc0\xb1\a\xfd\xec\x95>\b(\xfa~O\xfd\xe2\a6b\x97\xc6$?;\x8eJ/P\x9d\x17\xaaU\xc4\b') syz_io_uring_setup(0x49c, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x7fff, 0x0, 0x1}}, 0x40) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000240)=r2) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000040)={0x1, r2}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/246, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/70, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0x73, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000000)=0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000f}, 0x94) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="b80000001300e99900000000"], 0xb8}, 0x1, 0x0, 0x0, 0x1158e3b975e78980}, 0x0) ioctl$MON_IOCX_GET(0xffffffffffffffff, 0x40189206, 0x0) 0s ago: executing program 6 (id=9377): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x3a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1500000000"], 0x0}, 0x90) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x2, 0x2, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x0, 0x5}, {0x0, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x4bb6}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x44000}, 0x4000014) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0xa) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x8040) r3 = socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r3, 0x0, 0x4ffe6, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d1d7a440041601801f44010203010902120001000000000904"], 0x0) r4 = syz_open_dev$sndctrl(&(0x7f0000000000), 0xdc3, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r4, 0xc0045520, &(0x7f0000000040)=0x1) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0e000000040000000800000007"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af0ff00000000bfa20000000000000702000000feffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) kernel console output (not intermixed with test programs): "/dev/video0" dev="devtmpfs" ino=930 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 2685.736140][T23241] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 2685.767412][ T30] audit: type=1400 audit(1755015905.181:40333): avc: denied { ioctl } for pid=7594 comm="syz.7.9007" path="/dev/video0" dev="devtmpfs" ino=930 ioctlcmd=0x565c scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 2685.876814][T23241] usb 7-1: USB disconnect, device number 71 [ 2685.887626][ T30] audit: type=1400 audit(1755015905.811:40334): avc: denied { read write } for pid=7369 comm="syz-executor" name="loop7" dev="devtmpfs" ino=654 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2685.950367][ T7600] netlink: 44 bytes leftover after parsing attributes in process `syz.7.9008'. [ 2685.959686][ T7600] netlink: 43 bytes leftover after parsing attributes in process `syz.7.9008'. [ 2685.971428][ T30] audit: type=1400 audit(1755015905.811:40335): avc: denied { open } for pid=7369 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=654 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2686.131638][ T7600] netlink: 'syz.7.9008': attribute type 6 has an invalid length. [ 2686.287668][ T4072] Bluetooth: hci0: command tx timeout [ 2686.313384][ T7600] netlink: 43 bytes leftover after parsing attributes in process `syz.7.9008'. [ 2686.333875][ T30] audit: type=1400 audit(1755015905.811:40336): avc: denied { ioctl } for pid=7369 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=654 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2686.430820][ T30] audit: type=1400 audit(1755015905.841:40337): avc: denied { read } for pid=7598 comm="syz.7.9008" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 2687.529254][ T7620] bad cache= option: no%e [ 2687.529254][ T7620] [ 2687.535925][ T7620] CIFS: VFS: bad cache= option: no%e [ 2687.899317][ T4590] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2687.921189][ T4590] bond_slave_0: left promiscuous mode [ 2687.935695][ T4590] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2687.950443][ T4590] bond_slave_1: left promiscuous mode [ 2687.958903][ T4590] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 2687.968042][ T4590] dummy0: left promiscuous mode [ 2687.976704][ T4590] bond0 (unregistering): Released all slaves [ 2688.105457][ T4590] bond1 (unregistering): (slave vlan0): Releasing active interface [ 2688.114879][ T4590] bond1 (unregistering): Released all slaves [ 2688.310973][ T4590] : left promiscuous mode [ 2688.363929][ T4072] Bluetooth: hci0: command tx timeout [ 2688.418803][ T7626] FAULT_INJECTION: forcing a failure. [ 2688.418803][ T7626] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2688.452620][ T7626] CPU: 1 UID: 0 PID: 7626 Comm: syz.6.9016 Not tainted 6.17.0-rc1-syzkaller-00004-g53e760d89498 #0 PREEMPT(full) [ 2688.452649][ T7626] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2688.452660][ T7626] Call Trace: [ 2688.452666][ T7626] [ 2688.452674][ T7626] dump_stack_lvl+0x16c/0x1f0 [ 2688.452700][ T7626] should_fail_ex+0x512/0x640 [ 2688.452724][ T7626] _copy_from_iter+0x29f/0x16f0 [ 2688.452753][ T7626] ? __pfx__copy_from_iter+0x10/0x10 [ 2688.452775][ T7626] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 2688.452807][ T7626] copy_page_from_iter+0xde/0x180 [ 2688.452833][ T7626] tun_build_skb.constprop.0+0x2e8/0x1500 [ 2688.452866][ T7626] ? __pfx_tun_build_skb.constprop.0+0x10/0x10 [ 2688.452892][ T7626] ? __pfx_avc_perm_nonode+0x10/0x10 [ 2688.452913][ T7626] ? find_held_lock+0x2b/0x80 [ 2688.452951][ T7626] tun_get_user+0x14ae/0x3ce0 [ 2688.452985][ T7626] ? __pfx_tun_get_user+0x10/0x10 [ 2688.453011][ T7626] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 2688.453040][ T7626] ? find_held_lock+0x2b/0x80 [ 2688.453062][ T7626] ? tun_get+0x191/0x370 [ 2688.453089][ T7626] tun_chr_write_iter+0xdc/0x210 [ 2688.453115][ T7626] vfs_write+0x7d3/0x11d0 [ 2688.453134][ T7626] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 2688.453160][ T7626] ? __pfx_vfs_write+0x10/0x10 [ 2688.453182][ T7626] ? find_held_lock+0x2b/0x80 [ 2688.453219][ T7626] ksys_write+0x12a/0x250 [ 2688.453238][ T7626] ? __pfx_ksys_write+0x10/0x10 [ 2688.453264][ T7626] do_syscall_64+0xcd/0x4c0 [ 2688.453284][ T7626] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2688.453302][ T7626] RIP: 0033:0x7fa1b998d69f [ 2688.453317][ T7626] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 2688.453338][ T7626] RSP: 002b:00007fa1ba83a000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 2688.453354][ T7626] RAX: ffffffffffffffda RBX: 00007fa1b9bb5fa0 RCX: 00007fa1b998d69f [ 2688.453364][ T7626] RDX: 000000000000004a RSI: 0000200000000000 RDI: 00000000000000c8 [ 2688.453374][ T7626] RBP: 00007fa1ba83a090 R08: 0000000000000000 R09: 0000000000000000 [ 2688.453383][ T7626] R10: 000000000000004a R11: 0000000000000293 R12: 0000000000000001 [ 2688.453393][ T7626] R13: 00007fa1b9bb6038 R14: 00007fa1b9bb5fa0 R15: 00007ffd75fbddf8 [ 2688.453414][ T7626] [ 2688.712755][ T4590] tipc: Left network mode [ 2689.573010][ T7638] netlink: 'syz.1.9017': attribute type 21 has an invalid length. [ 2689.667413][ T7590] chnl_net:caif_netlink_parms(): no params data found [ 2689.741423][ T7646] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7646 comm=syz.6.9019 [ 2690.444067][ T4072] Bluetooth: hci0: command tx timeout [ 2690.497602][ T7638] netlink: 156 bytes leftover after parsing attributes in process `syz.1.9017'. [ 2690.516154][ T30] kauditd_printk_skb: 160 callbacks suppressed [ 2690.516170][ T30] audit: type=1400 audit(1755015910.621:40498): avc: denied { prog_load } for pid=7639 comm="syz.7.9018" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2690.544131][ T7644] netlink: 16 bytes leftover after parsing attributes in process `syz.7.9018'. [ 2690.553640][ T30] audit: type=1400 audit(1755015910.651:40499): avc: denied { bpf } for pid=7639 comm="syz.7.9018" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2690.583494][ T30] audit: type=1400 audit(1755015910.681:40500): avc: denied { create } for pid=7647 comm="syz.8.9020" anonclass=[secretmem] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 2690.756029][ T30] audit: type=1400 audit(1755015910.691:40501): avc: denied { prog_load } for pid=7647 comm="syz.8.9020" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2690.775582][ T30] audit: type=1400 audit(1755015910.691:40502): avc: denied { bpf } for pid=7647 comm="syz.8.9020" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2690.796621][ T30] audit: type=1400 audit(1755015910.691:40503): avc: denied { perfmon } for pid=7647 comm="syz.8.9020" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2690.818122][ T30] audit: type=1400 audit(1755015910.711:40504): avc: denied { prog_run } for pid=7647 comm="syz.8.9020" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2690.830021][ T7640] 8021q: adding VLAN 0 to HW filter on device bond1 [ 2690.837354][ T30] audit: type=1400 audit(1755015910.711:40505): avc: denied { read } for pid=7647 comm="syz.8.9020" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 2691.182100][ T30] audit: type=1400 audit(1755015910.711:40506): avc: denied { open } for pid=7647 comm="syz.8.9020" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 2691.223462][ T30] audit: type=1400 audit(1755015910.761:40507): avc: denied { create } for pid=7647 comm="syz.8.9020" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2691.227243][ T7640] team0: Port device bond1 added [ 2691.367976][ T7644] veth3: entered promiscuous mode [ 2691.375823][ T7644] veth3: entered allmulticast mode [ 2691.811415][ T7663] Bluetooth: MGMT ver 1.23 [ 2691.950624][ T7657] netlink: 44 bytes leftover after parsing attributes in process `syz.6.9022'. [ 2692.004579][ T7657] netlink: 43 bytes leftover after parsing attributes in process `syz.6.9022'. [ 2692.022975][ T7660] bridge0: port 2(bridge_slave_1) entered disabled state [ 2692.039460][ T7660] bridge0: port 1(bridge_slave_0) entered disabled state [ 2692.116234][ T7660] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2692.126680][ T7660] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2692.237252][ T7657] netlink: 'syz.6.9022': attribute type 6 has an invalid length. [ 2692.257999][ T7590] bridge0: port 1(bridge_slave_0) entered blocking state [ 2692.273472][ T7657] netlink: 43 bytes leftover after parsing attributes in process `syz.6.9022'. [ 2692.297062][ T7590] bridge0: port 1(bridge_slave_0) entered disabled state [ 2692.316107][ T7590] bridge_slave_0: entered allmulticast mode [ 2692.472131][ T7590] bridge_slave_0: entered promiscuous mode [ 2692.523538][ T4072] Bluetooth: hci0: command tx timeout [ 2692.670761][ T36] netdevsim netdevsim7 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2692.695343][ T36] netdevsim netdevsim7 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2692.748876][ T7675] netlink: 24 bytes leftover after parsing attributes in process `syz.8.9025'. [ 2692.760250][ T7590] bridge0: port 2(bridge_slave_1) entered blocking state [ 2692.768115][ T7590] bridge0: port 2(bridge_slave_1) entered disabled state [ 2692.778394][ T7590] bridge_slave_1: entered allmulticast mode [ 2692.789729][ T7590] bridge_slave_1: entered promiscuous mode [ 2692.820386][ T36] netdevsim netdevsim7 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2692.839018][ T36] netdevsim netdevsim7 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2693.926458][ T7676] sch_tbf: burst 88 is lower than device veth3 mtu (1514) ! [ 2693.993009][ T4590] hsr_slave_0: left promiscuous mode [ 2694.007892][ T4590] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2694.023804][ T4590] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2695.240628][ T4590] team0 (unregistering): Port device team_slave_1 removed [ 2695.310260][ T4590] team0 (unregistering): Port device team_slave_0 removed [ 2695.388792][ T7698] befs: (nullb0): invalid magic header [ 2695.872040][ T7590] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2695.936365][ T30] kauditd_printk_skb: 152 callbacks suppressed [ 2695.936376][ T30] audit: type=1400 audit(1755015916.041:40660): avc: denied { read write } for pid=7078 comm="syz-executor" name="loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2695.986839][ T7590] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2696.019237][ T30] audit: type=1400 audit(1755015916.071:40661): avc: denied { open } for pid=7078 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2696.204145][ T30] audit: type=1400 audit(1755015916.071:40662): avc: denied { ioctl } for pid=7078 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2696.231881][ T30] audit: type=1400 audit(1755015916.121:40663): avc: denied { read write } for pid=7369 comm="syz-executor" name="loop7" dev="devtmpfs" ino=654 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2696.273882][ T30] audit: type=1400 audit(1755015916.121:40664): avc: denied { read write open } for pid=7369 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=654 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2696.300622][ T7708] netlink: 196 bytes leftover after parsing attributes in process `syz.6.9035'. [ 2696.318371][ T30] audit: type=1400 audit(1755015916.121:40665): avc: denied { ioctl } for pid=7369 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=654 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2696.600987][ T7590] team0: Port device team_slave_0 added [ 2696.722915][ T7590] team0: Port device team_slave_1 added [ 2696.728727][ T30] audit: type=1400 audit(1755015916.161:40666): avc: denied { read write } for pid=7699 comm="syz.8.9033" name="fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 2696.812670][ T30] audit: type=1400 audit(1755015916.161:40667): avc: denied { open } for pid=7699 comm="syz.8.9033" path="/dev/fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 2696.905057][ T30] audit: type=1400 audit(1755015916.171:40668): avc: denied { execmem } for pid=7700 comm="syz.1.9032" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 2697.440065][ T30] audit: type=1400 audit(1755015916.171:40669): avc: denied { mounton } for pid=7702 comm="syz.7.9034" path="/14/bus" dev="tmpfs" ino=96 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 2697.894759][ T7723] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2698.245093][ T7590] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2698.252087][ T7590] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2698.319606][ T7590] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2698.350454][T26273] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 2698.375072][ T7590] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2698.401649][ T7590] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2698.443887][ T7590] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2698.545150][ T7728] netlink: 4 bytes leftover after parsing attributes in process `syz.6.9038'. [ 2698.563420][T26273] usb 2-1: Using ep0 maxpacket: 16 [ 2698.598133][ T4590] IPVS: stop unused estimator thread 0... [ 2698.618607][T26273] usb 2-1: config 5 has too many interfaces: 33, using maximum allowed: 32 [ 2698.663404][T26273] usb 2-1: config 5 has an invalid descriptor of length 34, skipping remainder of the config [ 2698.701495][ T7727] netlink: 44 bytes leftover after parsing attributes in process `syz.7.9040'. [ 2698.721374][ T7727] netlink: 43 bytes leftover after parsing attributes in process `syz.7.9040'. [ 2698.744188][T26273] usb 2-1: config 5 has 0 interfaces, different from the descriptor's value: 33 [ 2698.753911][T26273] usb 2-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 2698.765238][ T7727] netlink: 'syz.7.9040': attribute type 6 has an invalid length. [ 2698.776052][T26273] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2698.786497][ T7727] netlink: 43 bytes leftover after parsing attributes in process `syz.7.9040'. [ 2698.819654][ T7590] hsr_slave_0: entered promiscuous mode [ 2698.831872][ T7590] hsr_slave_1: entered promiscuous mode [ 2698.846190][ T7590] debugfs: 'hsr0' already exists in 'hsr' [ 2698.852501][ T7590] Cannot create hsr debugfs directory [ 2699.952536][ T7590] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 2699.965758][ T7590] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 2699.976049][ T7590] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 2699.986791][ T7590] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 2700.199184][ T7590] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2700.322786][ T7590] 8021q: adding VLAN 0 to HW filter on device team0 [ 2700.351919][ T7590] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 2700.370994][ T7590] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 2700.427478][ T7755] bad cache= option: no%e [ 2700.427478][ T7755] [ 2700.434129][ T7755] CIFS: VFS: bad cache= option: no%e [ 2700.666987][T26274] usb 2-1: USB disconnect, device number 95 [ 2700.974602][ T30] kauditd_printk_skb: 215 callbacks suppressed [ 2700.997210][ T30] audit: type=1400 audit(1755015921.071:40885): avc: denied { map_create } for pid=7741 comm="syz.7.9044" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2701.054048][ T30] audit: type=1400 audit(1755015921.071:40886): avc: denied { map_read map_write } for pid=7741 comm="syz.7.9044" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2701.105714][ T7758] befs: (nullb0): invalid magic header [ 2701.117436][ T30] audit: type=1400 audit(1755015921.141:40887): avc: denied { module_request } for pid=7590 comm="syz-executor" kmod="netdev-nicvf0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 2701.165328][T26539] bridge0: port 1(bridge_slave_0) entered blocking state [ 2701.172497][T26539] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2701.285017][ T7763] overlay: filesystem on ./bus not supported as upperdir [ 2701.286158][T26539] bridge0: port 2(bridge_slave_1) entered blocking state [ 2701.299217][T26539] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2701.310789][ T30] audit: type=1400 audit(1755015921.201:40888): avc: denied { prog_load } for pid=7741 comm="syz.7.9044" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2701.336166][ T30] audit: type=1400 audit(1755015921.201:40889): avc: denied { bpf } for pid=7741 comm="syz.7.9044" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2701.356757][ C1] vkms_vblank_simulate: vblank timer overrun [ 2701.459368][ T30] audit: type=1400 audit(1755015921.201:40890): avc: denied { perfmon } for pid=7741 comm="syz.7.9044" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2701.558068][ T7769] block nbd1: NBD_DISCONNECT [ 2701.852496][ T30] audit: type=1400 audit(1755015921.201:40891): avc: denied { bpf } for pid=7741 comm="syz.7.9044" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2701.964872][ T30] audit: type=1400 audit(1755015921.211:40892): avc: denied { prog_run } for pid=7741 comm="syz.7.9044" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2702.019599][ T30] audit: type=1400 audit(1755015921.211:40893): avc: denied { mounton } for pid=7741 comm="syz.7.9044" path="/18/file0" dev="tmpfs" ino=125 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 2702.093420][ T30] audit: type=1400 audit(1755015921.291:40894): avc: denied { read } for pid=7761 comm="syz.1.9047" dev="nsfs" ino=4026533014 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 2702.147787][ T7776] netlink: 'syz.6.9050': attribute type 21 has an invalid length. [ 2702.156043][ T7776] netlink: 156 bytes leftover after parsing attributes in process `syz.6.9050'. [ 2702.380642][ T7590] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2702.776282][ T7590] veth0_vlan: entered promiscuous mode [ 2702.797285][ T7590] veth1_vlan: entered promiscuous mode [ 2702.819839][ T7590] veth0_macvtap: entered promiscuous mode [ 2702.828101][ T7590] veth1_macvtap: entered promiscuous mode [ 2702.894517][ T7590] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2702.939483][ T7590] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2703.277086][ T6046] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2703.297093][ T6046] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2703.331875][ T6046] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2703.529364][ T6046] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2703.687267][ T4590] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2703.713428][ T4590] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2703.802840][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2703.829078][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2705.209434][ T7814] netlink: 'syz.3.9062': attribute type 21 has an invalid length. [ 2705.217390][ T7814] netlink: 156 bytes leftover after parsing attributes in process `syz.3.9062'. [ 2705.798165][ T7822] FAULT_INJECTION: forcing a failure. [ 2705.798165][ T7822] name failslab, interval 1, probability 0, space 0, times 0 [ 2705.837192][ T7822] CPU: 1 UID: 0 PID: 7822 Comm: syz.1.9063 Not tainted 6.17.0-rc1-syzkaller-00004-g53e760d89498 #0 PREEMPT(full) [ 2705.837221][ T7822] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2705.837232][ T7822] Call Trace: [ 2705.837238][ T7822] [ 2705.837245][ T7822] dump_stack_lvl+0x16c/0x1f0 [ 2705.837269][ T7822] should_fail_ex+0x512/0x640 [ 2705.837289][ T7822] ? fs_reclaim_acquire+0xae/0x150 [ 2705.837315][ T7822] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 2705.837340][ T7822] should_failslab+0xc2/0x120 [ 2705.837361][ T7822] __kmalloc_noprof+0xd2/0x510 [ 2705.837385][ T7822] tomoyo_realpath_from_path+0xc2/0x6e0 [ 2705.837413][ T7822] ? tomoyo_profile+0x47/0x60 [ 2705.837432][ T7822] tomoyo_path_number_perm+0x245/0x580 [ 2705.837453][ T7822] ? tomoyo_path_number_perm+0x237/0x580 [ 2705.837477][ T7822] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 2705.837501][ T7822] ? find_held_lock+0x2b/0x80 [ 2705.837546][ T7822] ? find_held_lock+0x2b/0x80 [ 2705.837567][ T7822] ? hook_file_ioctl_common+0x145/0x410 [ 2705.837591][ T7822] ? __fget_files+0x20e/0x3c0 [ 2705.837615][ T7822] security_file_ioctl+0x9b/0x240 [ 2705.837641][ T7822] __x64_sys_ioctl+0xb7/0x210 [ 2705.837671][ T7822] do_syscall_64+0xcd/0x4c0 [ 2705.837691][ T7822] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2705.837710][ T7822] RIP: 0033:0x7f892e98ebe9 [ 2705.837725][ T7822] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2705.837742][ T7822] RSP: 002b:00007f892f7ec038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2705.837759][ T7822] RAX: ffffffffffffffda RBX: 00007f892ebb6090 RCX: 00007f892e98ebe9 [ 2705.837770][ T7822] RDX: 00002000000000c0 RSI: 00000000c0d05605 RDI: 0000000000000009 [ 2705.837782][ T7822] RBP: 00007f892f7ec090 R08: 0000000000000000 R09: 0000000000000000 [ 2705.837792][ T7822] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2705.837803][ T7822] R13: 00007f892ebb6128 R14: 00007f892ebb6090 R15: 00007fffb71e0a98 [ 2705.837827][ T7822] [ 2705.837834][ T7822] ERROR: Out of memory at tomoyo_realpath_from_path. [ 2706.051678][ T30] kauditd_printk_skb: 279 callbacks suppressed [ 2706.051694][ T30] audit: type=1400 audit(1755015926.151:41174): avc: denied { create } for pid=7816 comm="syz.3.9064" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2706.091472][ T7827] netlink: 56 bytes leftover after parsing attributes in process `syz.3.9064'. [ 2706.295765][ T7831] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7831 comm=syz.7.9067 [ 2706.786867][ T30] audit: type=1400 audit(1755015926.151:41175): avc: denied { read write } for pid=7826 comm="syz.7.9067" name="rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 2706.811394][ T30] audit: type=1400 audit(1755015926.151:41176): avc: denied { open } for pid=7826 comm="syz.7.9067" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 2706.836592][ C1] vkms_vblank_simulate: vblank timer overrun [ 2706.843052][ T30] audit: type=1400 audit(1755015926.191:41177): avc: denied { write } for pid=7816 comm="syz.3.9064" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2706.863471][ C1] vkms_vblank_simulate: vblank timer overrun [ 2706.870218][ T30] audit: type=1400 audit(1755015926.191:41178): avc: denied { read } for pid=7816 comm="syz.3.9064" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2706.891657][ T30] audit: type=1400 audit(1755015926.191:41179): avc: denied { read } for pid=7826 comm="syz.7.9067" name="binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 2706.914433][ C1] vkms_vblank_simulate: vblank timer overrun [ 2706.927448][ T30] audit: type=1400 audit(1755015926.191:41180): avc: denied { read open } for pid=7826 comm="syz.7.9067" path="/dev/binderfs/binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 2706.951872][ C1] vkms_vblank_simulate: vblank timer overrun [ 2706.969271][ T7834] netlink: 36 bytes leftover after parsing attributes in process `syz.8.9069'. [ 2706.983491][ T7834] sp0: Synchronizing with TNC [ 2706.992802][ T7832] [U] è [ 2707.027571][ T30] audit: type=1400 audit(1755015926.191:41181): avc: denied { ioctl } for pid=7816 comm="syz.3.9064" path="socket:[161248]" dev="sockfs" ino=161248 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2707.053517][ C1] vkms_vblank_simulate: vblank timer overrun [ 2707.202343][ T30] audit: type=1400 audit(1755015926.191:41182): avc: denied { write } for pid=7816 comm="syz.3.9064" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2707.225187][ T30] audit: type=1400 audit(1755015926.191:41183): avc: denied { map_create } for pid=7816 comm="syz.3.9064" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2707.321516][ T7836] : renamed from bridge_slave_0 [ 2709.824874][ T7846] netlink: 44 bytes leftover after parsing attributes in process `syz.6.9073'. [ 2710.426637][ T7880] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2710.931338][ T7884] netlink: 'syz.6.9080': attribute type 2 has an invalid length. [ 2711.043535][T26275] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 2711.071540][ T30] kauditd_printk_skb: 210 callbacks suppressed [ 2711.071551][ T30] audit: type=1400 audit(1755015931.171:41394): avc: denied { ioctl } for pid=7874 comm="syz.1.9079" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2711.093286][ T7884] netlink: 4 bytes leftover after parsing attributes in process `syz.6.9080'. [ 2711.103574][ C1] vkms_vblank_simulate: vblank timer overrun [ 2711.269081][ T30] audit: type=1400 audit(1755015931.171:41395): avc: denied { ioctl } for pid=7874 comm="syz.1.9079" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2711.423129][T26275] usb 2-1: Using ep0 maxpacket: 16 [ 2711.451119][T26275] usb 2-1: config 5 has too many interfaces: 33, using maximum allowed: 32 [ 2711.460859][ T30] audit: type=1400 audit(1755015931.181:41396): avc: denied { sys_module } for pid=7876 comm="syz.6.9080" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 2711.481964][ C1] vkms_vblank_simulate: vblank timer overrun [ 2711.500256][T26275] usb 2-1: config 5 has an invalid descriptor of length 34, skipping remainder of the config [ 2711.512295][ T30] audit: type=1400 audit(1755015931.181:41397): avc: denied { module_request } for pid=7876 comm="syz.6.9080" kmod="veth1_to_hsr" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 2711.564915][T26275] usb 2-1: config 5 has 0 interfaces, different from the descriptor's value: 33 [ 2711.568711][ T30] audit: type=1400 audit(1755015931.191:41398): avc: denied { create } for pid=7876 comm="syz.6.9080" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2711.601799][ T30] audit: type=1400 audit(1755015931.231:41399): avc: denied { ioctl } for pid=7874 comm="syz.1.9079" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2711.627140][ T30] audit: type=1400 audit(1755015931.301:41400): avc: denied { ioctl } for pid=7874 comm="syz.1.9079" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2711.653577][T26275] usb 2-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 2711.682909][ T30] audit: type=1400 audit(1755015931.311:41401): avc: denied { read write } for pid=7864 comm="syz.3.9077" name="virtual_nci" dev="devtmpfs" ino=698 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2711.720865][T26275] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2711.784738][ T30] audit: type=1400 audit(1755015931.311:41402): avc: denied { open } for pid=7864 comm="syz.3.9077" path="/dev/virtual_nci" dev="devtmpfs" ino=698 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2711.877957][ T30] audit: type=1400 audit(1755015931.311:41403): avc: denied { read } for pid=7864 comm="syz.3.9077" dev="nsfs" ino=4026533351 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 2712.243608][T26275] usb 9-1: new high-speed USB device number 71 using dummy_hcd [ 2712.415607][ T7900] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7900 comm=syz.3.9084 [ 2712.847778][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 2712.854152][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 2713.258979][ T5886] usb 2-1: USB disconnect, device number 96 [ 2713.283423][T26275] usb 9-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 2713.292331][T26275] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 2713.360269][T26275] usb 9-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2713.382596][T26275] usb 9-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 2714.543400][T26275] usb 9-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 2714.561099][T26275] usb 9-1: Product: syz [ 2714.566886][T26275] usb 9-1: Manufacturer: syz [ 2714.645888][T26275] cdc_wdm 9-1:1.0: skipping garbage [ 2714.671516][T26275] cdc_wdm 9-1:1.0: probe with driver cdc_wdm failed with error -22 [ 2714.830892][T26275] usb 9-1: USB disconnect, device number 71 [ 2715.116451][ T7924] netlink: 56 bytes leftover after parsing attributes in process `syz.1.9086'. [ 2716.111251][ T30] kauditd_printk_skb: 175 callbacks suppressed [ 2716.111263][ T30] audit: type=1400 audit(1755015936.211:41579): avc: denied { read write } for pid=4559 comm="syz-executor" name="loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2716.303649][ T30] audit: type=1400 audit(1755015936.211:41580): avc: denied { open } for pid=4559 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2716.329293][ T30] audit: type=1400 audit(1755015936.211:41581): avc: denied { ioctl } for pid=4559 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=653 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2716.434874][ T7936] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2716.743464][T23241] usb 7-1: new high-speed USB device number 72 using dummy_hcd [ 2716.836469][ T30] audit: type=1400 audit(1755015936.321:41582): avc: denied { execmem } for pid=7933 comm="syz.6.9093" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 2716.943909][ T30] audit: type=1400 audit(1755015936.521:41583): avc: denied { prog_load } for pid=7933 comm="syz.6.9093" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2716.963485][T23241] usb 7-1: Using ep0 maxpacket: 16 [ 2716.993757][T23241] usb 7-1: config 5 has too many interfaces: 33, using maximum allowed: 32 [ 2717.022751][ T30] audit: type=1400 audit(1755015936.521:41584): avc: denied { bpf } for pid=7933 comm="syz.6.9093" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2717.049088][T23241] usb 7-1: config 5 has an invalid descriptor of length 34, skipping remainder of the config [ 2717.163484][T23241] usb 7-1: config 5 has 0 interfaces, different from the descriptor's value: 33 [ 2717.172802][ T30] audit: type=1400 audit(1755015936.531:41585): avc: denied { map_create } for pid=7933 comm="syz.6.9093" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2717.183051][T23241] usb 7-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 2717.239209][T23241] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2717.247670][ T30] audit: type=1400 audit(1755015936.531:41586): avc: denied { read } for pid=7933 comm="syz.6.9093" name="iommu" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2717.370069][ T30] audit: type=1400 audit(1755015936.531:41587): avc: denied { open } for pid=7933 comm="syz.6.9093" path="/dev/iommu" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2717.483048][ T30] audit: type=1400 audit(1755015936.531:41588): avc: denied { ioctl } for pid=7933 comm="syz.6.9093" path="/dev/iommu" dev="devtmpfs" ino=624 ioctlcmd=0x3b81 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2717.704285][ T7942] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7942 comm=syz.8.9095 [ 2719.241280][T23241] usb 7-1: USB disconnect, device number 72 [ 2719.657470][ T7958] openvswitch: netlink: Multiple metadata blocks provided [ 2719.673806][ T7959] overlayfs: missing 'lowerdir' [ 2720.351896][ T7965] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9103'. [ 2720.447934][ T4072] Bluetooth: hci1: command 0x0406 tx timeout [ 2721.039210][ T7972] netlink: 44 bytes leftover after parsing attributes in process `syz.6.9104'. [ 2721.048383][ T7972] netlink: 43 bytes leftover after parsing attributes in process `syz.6.9104'. [ 2721.069318][ T7972] netlink: 'syz.6.9104': attribute type 6 has an invalid length. [ 2721.080171][ T7972] netlink: 43 bytes leftover after parsing attributes in process `syz.6.9104'. [ 2721.181052][ T30] kauditd_printk_skb: 142 callbacks suppressed [ 2721.181067][ T30] audit: type=1400 audit(1755015941.281:41731): avc: denied { create } for pid=7967 comm="syz.8.9105" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2721.214371][ T7979] netlink: 56 bytes leftover after parsing attributes in process `syz.8.9105'. [ 2721.473386][ T30] audit: type=1400 audit(1755015941.311:41732): avc: denied { write } for pid=7967 comm="syz.8.9105" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2721.505645][ T30] audit: type=1400 audit(1755015941.311:41733): avc: denied { read } for pid=7967 comm="syz.8.9105" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2721.531619][ T30] audit: type=1400 audit(1755015941.311:41734): avc: denied { ioctl } for pid=7967 comm="syz.8.9105" path="socket:[161418]" dev="sockfs" ino=161418 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2721.659402][ T30] audit: type=1400 audit(1755015941.311:41735): avc: denied { map_create } for pid=7967 comm="syz.8.9105" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2721.753421][ T30] audit: type=1400 audit(1755015941.311:41736): avc: denied { create } for pid=7967 comm="syz.8.9105" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 2721.843654][ T30] audit: type=1400 audit(1755015941.311:41737): avc: denied { write } for pid=7967 comm="syz.8.9105" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 2721.870087][ T30] audit: type=1400 audit(1755015941.411:41738): avc: denied { read } for pid=7967 comm="syz.8.9105" dev="nsfs" ino=4026534095 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 2721.904218][ T30] audit: type=1400 audit(1755015941.411:41739): avc: denied { open } for pid=7967 comm="syz.8.9105" path="net:[4026534095]" dev="nsfs" ino=4026534095 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 2721.965939][ T30] audit: type=1400 audit(1755015941.411:41740): avc: denied { create } for pid=7967 comm="syz.8.9105" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2722.178431][ T7989] netlink: 32 bytes leftover after parsing attributes in process `syz.8.9108'. [ 2722.187932][ T7989] netlink: 12 bytes leftover after parsing attributes in process `syz.8.9108'. [ 2722.205195][ T7989] syz.8.9108: attempt to access beyond end of device [ 2722.205195][ T7989] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 2723.041187][ T7987] vhci_hcd vhci_hcd.0: pdev(8) rhport(0) sockfd(10) [ 2723.047803][ T7987] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 2723.056058][ T7988] vhci_hcd: connection closed [ 2723.063524][ T7987] vhci_hcd vhci_hcd.0: Device attached [ 2723.165366][ T7998] FAULT_INJECTION: forcing a failure. [ 2723.165366][ T7998] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2723.184527][ T6036] vhci_hcd: stop threads [ 2723.188805][ T6036] vhci_hcd: release socket [ 2723.204211][ T6036] vhci_hcd: disconnect device [ 2723.221621][ T7998] CPU: 0 UID: 0 PID: 7998 Comm: syz.7.9110 Not tainted 6.17.0-rc1-syzkaller-00004-g53e760d89498 #0 PREEMPT(full) [ 2723.221647][ T7998] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2723.221657][ T7998] Call Trace: [ 2723.221662][ T7998] [ 2723.221669][ T7998] dump_stack_lvl+0x16c/0x1f0 [ 2723.221692][ T7998] should_fail_ex+0x512/0x640 [ 2723.221716][ T7998] _copy_to_iter+0x463/0x16f0 [ 2723.221745][ T7998] ? __pfx__copy_to_iter+0x10/0x10 [ 2723.221764][ T7998] ? print_binder_stats+0x1fe/0x410 [ 2723.221790][ T7998] ? stats_show+0x579/0x650 [ 2723.221813][ T7998] seq_read_iter+0xcf8/0x12c0 [ 2723.221844][ T7998] seq_read+0x3a3/0x570 [ 2723.221861][ T7998] ? __pfx_seq_read+0x10/0x10 [ 2723.221899][ T7998] full_proxy_read+0x12e/0x1a0 [ 2723.221927][ T7998] ? __pfx_full_proxy_read+0x10/0x10 [ 2723.221955][ T7998] vfs_read+0x1e1/0xcf0 [ 2723.221976][ T7998] ? __pfx___mutex_lock+0x10/0x10 [ 2723.221995][ T7998] ? __pfx_vfs_read+0x10/0x10 [ 2723.222026][ T7998] ? __fget_files+0x20e/0x3c0 [ 2723.222056][ T7998] ksys_read+0x12a/0x250 [ 2723.222073][ T7998] ? __pfx_ksys_read+0x10/0x10 [ 2723.222101][ T7998] do_syscall_64+0xcd/0x4c0 [ 2723.222123][ T7998] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2723.222140][ T7998] RIP: 0033:0x7f7bc478ebe9 [ 2723.222154][ T7998] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2723.222170][ T7998] RSP: 002b:00007f7bc29ee038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2723.222185][ T7998] RAX: ffffffffffffffda RBX: 00007f7bc49b5fa0 RCX: 00007f7bc478ebe9 [ 2723.222196][ T7998] RDX: 0000000000000077 RSI: 0000200000000580 RDI: 0000000000000006 [ 2723.222205][ T7998] RBP: 00007f7bc29ee090 R08: 0000000000000000 R09: 0000000000000000 [ 2723.222215][ T7998] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2723.222225][ T7998] R13: 00007f7bc49b6038 R14: 00007f7bc49b5fa0 R15: 00007ffefe318098 [ 2723.222248][ T7998] [ 2723.230132][ T7997] netlink: 'syz.3.9107': attribute type 2 has an invalid length. [ 2723.367253][ C1] vkms_vblank_simulate: vblank timer overrun [ 2723.433078][T26275] vhci_hcd: vhci_device speed not set [ 2723.570109][ T7997] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9107'. [ 2723.885471][ T8010] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8010 comm=syz.7.9113 [ 2723.904203][T26274] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 2724.113475][T26274] usb 2-1: Using ep0 maxpacket: 16 [ 2724.492933][T26274] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2724.618295][T26274] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 2724.618342][T26274] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 2724.618362][T26274] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2724.628015][T26274] usb 2-1: config 0 descriptor?? [ 2724.699130][ T7997] hsr_slave_1 (unregistering): left promiscuous mode [ 2724.762731][ T8016] overlayfs: missing 'lowerdir' [ 2725.561201][ T8021] netlink: 36 bytes leftover after parsing attributes in process `syz.8.9117'. [ 2725.601802][ T8021] sp0: Synchronizing with TNC [ 2725.622988][T26274] microsoft 0003:045E:07DA.003D: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 [ 2725.714066][ T8020] [U] è [ 2725.740964][T26274] microsoft 0003:045E:07DA.003D: no inputs found [ 2725.785894][T26274] microsoft 0003:045E:07DA.003D: could not initialize ff, continuing anyway [ 2725.829508][T26274] usb 2-1: USB disconnect, device number 97 [ 2726.149803][ T8032] netlink: 56 bytes leftover after parsing attributes in process `syz.3.9118'. [ 2726.225658][ T8035] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2726.237902][ T30] kauditd_printk_skb: 187 callbacks suppressed [ 2726.237918][ T30] audit: type=1400 audit(1755015946.321:41928): avc: denied { prog_load } for pid=8029 comm="syz.6.9120" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2726.456904][ T8038] netlink: 60 bytes leftover after parsing attributes in process `syz.8.9121'. [ 2726.707411][ T30] audit: type=1400 audit(1755015946.321:41929): avc: denied { bpf } for pid=8029 comm="syz.6.9120" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2726.728607][ T30] audit: type=1400 audit(1755015946.321:41930): avc: denied { map_create } for pid=8029 comm="syz.6.9120" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2726.749739][ T30] audit: type=1400 audit(1755015946.331:41931): avc: denied { read } for pid=8029 comm="syz.6.9120" name="iommu" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2726.773054][ T30] audit: type=1400 audit(1755015946.331:41932): avc: denied { open } for pid=8029 comm="syz.6.9120" path="/dev/iommu" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2726.964576][ T30] audit: type=1400 audit(1755015946.331:41933): avc: denied { ioctl } for pid=8029 comm="syz.6.9120" path="/dev/iommu" dev="devtmpfs" ino=624 ioctlcmd=0x3b81 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2726.997268][ T30] audit: type=1400 audit(1755015946.551:41934): avc: denied { create } for pid=8030 comm="syz.8.9121" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 2727.017516][ T30] audit: type=1400 audit(1755015946.551:41935): avc: denied { create } for pid=8030 comm="syz.8.9121" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 2727.143993][ T30] audit: type=1400 audit(1755015946.561:41936): avc: denied { write } for pid=8030 comm="syz.8.9121" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 2727.165482][ T30] audit: type=1400 audit(1755015946.561:41937): avc: denied { nlmsg_write } for pid=8030 comm="syz.8.9121" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 2728.627511][ T8046] lo speed is unknown, defaulting to 1000 [ 2729.445573][ T8065] netlink: 44 bytes leftover after parsing attributes in process `syz.1.9128'. [ 2729.483892][ T8065] netlink: 43 bytes leftover after parsing attributes in process `syz.1.9128'. [ 2729.682795][ T8065] netlink: 'syz.1.9128': attribute type 6 has an invalid length. [ 2729.718628][ T8065] netlink: 43 bytes leftover after parsing attributes in process `syz.1.9128'. [ 2731.442486][ T30] kauditd_printk_skb: 114 callbacks suppressed [ 2731.442506][ T30] audit: type=1400 audit(1755015951.241:42052): avc: denied { ioctl } for pid=8075 comm="syz.7.9131" path="/dev/comedi3" dev="devtmpfs" ino=1279 ioctlcmd=0x640c scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2731.543495][ T30] audit: type=1400 audit(1755015951.531:42053): avc: denied { read write } for pid=4559 comm="syz-executor" name="loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2731.589102][ T30] audit: type=1400 audit(1755015951.531:42054): avc: denied { read write open } for pid=4559 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2731.616112][ T30] audit: type=1400 audit(1755015951.531:42055): avc: denied { ioctl } for pid=4559 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=653 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2731.664009][ T30] audit: type=1400 audit(1755015951.701:42056): avc: denied { read write } for pid=7590 comm="syz-executor" name="loop3" dev="devtmpfs" ino=650 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2731.777103][ T8076] netlink: 44 bytes leftover after parsing attributes in process `syz.7.9131'. [ 2731.790165][ T8076] netlink: 43 bytes leftover after parsing attributes in process `syz.7.9131'. [ 2731.845849][ T8076] netlink: 'syz.7.9131': attribute type 6 has an invalid length. [ 2731.873422][ T8076] netlink: 43 bytes leftover after parsing attributes in process `syz.7.9131'. [ 2731.912316][ T30] audit: type=1400 audit(1755015951.701:42057): avc: denied { open } for pid=7590 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=650 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2732.099144][ T30] audit: type=1400 audit(1755015951.701:42058): avc: denied { ioctl } for pid=7590 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=650 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2732.188948][ T30] audit: type=1400 audit(1755015951.771:42059): avc: denied { ioctl } for pid=8075 comm="syz.7.9131" path="/dev/ocfs2_control" dev="devtmpfs" ino=101 ioctlcmd=0x5504 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2732.227515][ T30] audit: type=1400 audit(1755015951.771:42060): avc: denied { map_create } for pid=8081 comm="syz.6.9132" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2732.284227][ T30] audit: type=1400 audit(1755015951.771:42061): avc: denied { perfmon } for pid=8081 comm="syz.6.9132" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2732.592822][ T8094] netlink: 4 bytes leftover after parsing attributes in process `syz.7.9134'. [ 2733.281562][ T8095] netlink: 56 bytes leftover after parsing attributes in process `syz.3.9133'. [ 2733.331752][ T8091] bridge0: port 2(bridge_slave_1) entered disabled state [ 2733.339070][ T8091] bridge0: port 1(bridge_slave_0) entered disabled state [ 2733.388871][ T8091] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2733.400050][ T8091] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2733.467830][ T13] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2733.556471][ T13] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2733.580665][ T13] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2733.834958][ T13] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2734.173704][ T5886] usb 2-1: new high-speed USB device number 98 using dummy_hcd [ 2734.364352][ T5886] usb 2-1: Using ep0 maxpacket: 8 [ 2734.624230][ T5886] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 2734.657599][ T5886] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2734.831686][ T5886] usb 2-1: Product: syz [ 2734.837040][ T8118] netlink: 12 bytes leftover after parsing attributes in process `syz.6.9140'. [ 2734.846256][ T8118] netlink: 19 bytes leftover after parsing attributes in process `syz.6.9140'. [ 2734.849480][ T5886] usb 2-1: Manufacturer: syz [ 2734.861135][ T5886] usb 2-1: SerialNumber: syz [ 2734.873925][ T5886] usb 2-1: config 0 descriptor?? [ 2734.989274][ T8118] sp0: Synchronizing with TNC [ 2735.134155][ T5886] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 2735.168071][ T8122] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2735.237054][ T8115] [U] è [ 2735.344925][ T8101] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2735.359553][ T8101] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2735.433478][T31582] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 2735.603425][T31582] usb 4-1: Using ep0 maxpacket: 16 [ 2735.630349][T31582] usb 4-1: config 5 has too many interfaces: 33, using maximum allowed: 32 [ 2735.643847][T31582] usb 4-1: config 5 has an invalid descriptor of length 34, skipping remainder of the config [ 2735.839337][ T5886] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 2735.892146][T31582] usb 4-1: config 5 has 0 interfaces, different from the descriptor's value: 33 [ 2735.902411][T31582] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 2735.911606][T31582] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2736.184138][ T8133] netlink: 44 bytes leftover after parsing attributes in process `syz.8.9145'. [ 2736.193377][ T8133] netlink: 43 bytes leftover after parsing attributes in process `syz.8.9145'. [ 2736.205332][ T8133] netlink: 'syz.8.9145': attribute type 6 has an invalid length. [ 2736.213200][ T8133] netlink: 43 bytes leftover after parsing attributes in process `syz.8.9145'. [ 2736.447482][ T30] kauditd_printk_skb: 197 callbacks suppressed [ 2736.447495][ T30] audit: type=1400 audit(1755015956.551:42259): avc: denied { ioctl } for pid=8136 comm="syz.6.9146" path="/dev/video37" dev="devtmpfs" ino=1050 ioctlcmd=0x5627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 2736.480528][ T30] audit: type=1400 audit(1755015956.581:42260): avc: denied { create } for pid=8136 comm="syz.6.9146" anonclass=[secretmem] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 2736.503264][ T30] audit: type=1400 audit(1755015956.581:42261): avc: denied { read } for pid=8136 comm="syz.6.9146" dev="nsfs" ino=4026533131 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 2736.525240][ T30] audit: type=1400 audit(1755015956.581:42262): avc: denied { open } for pid=8136 comm="syz.6.9146" path="net:[4026533131]" dev="nsfs" ino=4026533131 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 2736.549455][ T30] audit: type=1400 audit(1755015956.581:42263): avc: denied { create } for pid=8136 comm="syz.6.9146" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 2736.570474][ T30] audit: type=1326 audit(1755015956.581:42264): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8136 comm="syz.6.9146" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa1b998ebe9 code=0x7ffc0000 [ 2736.616009][ T30] audit: type=1326 audit(1755015956.581:42265): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8136 comm="syz.6.9146" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa1b998ebe9 code=0x7ffc0000 [ 2736.640235][ T30] audit: type=1326 audit(1755015956.581:42266): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8136 comm="syz.6.9146" exe="/root/syz-executor" sig=0 arch=c000003e syscall=261 compat=0 ip=0x7fa1b998ebe9 code=0x7ffc0000 [ 2736.690408][ T30] audit: type=1400 audit(1755015956.581:42267): avc: denied { write } for pid=8136 comm="syz.6.9146" name="secretmem" dev="secretmem" ino=162084 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 2736.877079][ T5886] usb 2-1: USB disconnect, device number 98 [ 2736.896682][ T30] audit: type=1326 audit(1755015956.581:42268): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8136 comm="syz.6.9146" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa1b998ebe9 code=0x7ffc0000 [ 2737.227938][ T8150] netlink: 'syz.1.9148': attribute type 21 has an invalid length. [ 2737.236132][ T8150] netlink: 156 bytes leftover after parsing attributes in process `syz.1.9148'. [ 2737.837671][ T8163] netlink: 4 bytes leftover after parsing attributes in process `syz.6.9152'. [ 2738.219015][ T6886] usb 4-1: USB disconnect, device number 82 [ 2738.696374][ T8171] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9155'. [ 2738.793202][ T8173] netlink: 8 bytes leftover after parsing attributes in process `syz.6.9156'. [ 2739.237357][ T8171] : Can't lookup blockdev [ 2740.593630][ T8185] netlink: 44 bytes leftover after parsing attributes in process `syz.1.9159'. [ 2741.111221][ T8186] netlink: 44 bytes leftover after parsing attributes in process `syz.6.9160'. [ 2741.125798][ T8186] netlink: 43 bytes leftover after parsing attributes in process `syz.6.9160'. [ 2741.137577][ T8186] netlink: 'syz.6.9160': attribute type 6 has an invalid length. [ 2741.148407][ T8186] netlink: 43 bytes leftover after parsing attributes in process `syz.6.9160'. [ 2741.528628][ T30] kauditd_printk_skb: 280 callbacks suppressed [ 2741.528690][ T30] audit: type=1400 audit(1755015961.611:42549): avc: denied { ioctl } for pid=8197 comm="syz.8.9164" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2741.603870][T26274] usb 9-1: new high-speed USB device number 72 using dummy_hcd [ 2741.731246][ T30] audit: type=1400 audit(1755015961.641:42550): avc: denied { read write } for pid=7369 comm="syz-executor" name="loop7" dev="devtmpfs" ino=654 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2741.903402][ T30] audit: type=1400 audit(1755015961.641:42551): avc: denied { open } for pid=7369 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=654 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2741.933612][ T30] audit: type=1400 audit(1755015961.641:42552): avc: denied { ioctl } for pid=7369 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=654 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2741.943387][T26274] usb 9-1: Using ep0 maxpacket: 32 [ 2741.960339][ T30] audit: type=1400 audit(1755015961.761:42553): avc: denied { ioctl } for pid=8197 comm="syz.8.9164" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2742.423465][ T30] audit: type=1400 audit(1755015961.791:42554): avc: denied { create } for pid=8202 comm="syz.1.9163" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 2742.445509][ T30] audit: type=1400 audit(1755015961.831:42555): avc: denied { bind } for pid=8202 comm="syz.1.9163" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 2742.479433][ T8218] FAULT_INJECTION: forcing a failure. [ 2742.479433][ T8218] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2742.514153][T26274] usb 9-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 2742.515672][ T8218] CPU: 0 UID: 0 PID: 8218 Comm: syz.3.9169 Not tainted 6.17.0-rc1-syzkaller-00004-g53e760d89498 #0 PREEMPT(full) [ 2742.515693][ T8218] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2742.515703][ T8218] Call Trace: [ 2742.515709][ T8218] [ 2742.515715][ T8218] dump_stack_lvl+0x16c/0x1f0 [ 2742.515737][ T8218] should_fail_ex+0x512/0x640 [ 2742.515757][ T8218] _copy_from_user+0x2e/0xd0 [ 2742.515778][ T8218] copy_msghdr_from_user+0x98/0x160 [ 2742.515794][ T8218] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 2742.515813][ T8218] ? __pfx__kstrtoull+0x10/0x10 [ 2742.515840][ T8218] ___sys_sendmsg+0xfe/0x1d0 [ 2742.515856][ T8218] ? __pfx____sys_sendmsg+0x10/0x10 [ 2742.515882][ T8218] ? find_held_lock+0x2b/0x80 [ 2742.515914][ T8218] __sys_sendmmsg+0x200/0x420 [ 2742.515932][ T8218] ? __pfx___sys_sendmmsg+0x10/0x10 [ 2742.515955][ T8218] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2742.515980][ T8218] ? fput+0x9b/0xd0 [ 2742.516000][ T8218] ? ksys_write+0x1ac/0x250 [ 2742.516015][ T8218] ? __pfx_ksys_write+0x10/0x10 [ 2742.516034][ T8218] __x64_sys_sendmmsg+0x9c/0x100 [ 2742.516048][ T8218] ? lockdep_hardirqs_on+0x7c/0x110 [ 2742.516063][ T8218] do_syscall_64+0xcd/0x4c0 [ 2742.516080][ T8218] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2742.516095][ T8218] RIP: 0033:0x7ffa9bf8ebe9 [ 2742.516107][ T8218] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2742.516122][ T8218] RSP: 002b:00007ffa9ceb6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 2742.516137][ T8218] RAX: ffffffffffffffda RBX: 00007ffa9c1b5fa0 RCX: 00007ffa9bf8ebe9 [ 2742.516147][ T8218] RDX: 0000000000000002 RSI: 0000200000000a00 RDI: 0000000000000003 [ 2742.516155][ T8218] RBP: 00007ffa9ceb6090 R08: 0000000000000000 R09: 0000000000000000 [ 2742.516164][ T8218] R10: 0000000020080058 R11: 0000000000000246 R12: 0000000000000001 [ 2742.516173][ T8218] R13: 00007ffa9c1b6038 R14: 00007ffa9c1b5fa0 R15: 00007ffc30cc4b88 [ 2742.516194][ T8218] [ 2742.633526][ T30] audit: type=1400 audit(1755015961.831:42556): avc: denied { name_bind } for pid=8202 comm="syz.1.9163" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 2742.756762][T26274] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2742.766969][T26274] usb 9-1: Product: syz [ 2742.771255][T26274] usb 9-1: Manufacturer: syz [ 2742.777183][T26274] usb 9-1: SerialNumber: syz [ 2742.818945][ T8224] netlink: 48 bytes leftover after parsing attributes in process `syz.6.9170'. [ 2743.209319][ T8224] input: syz1 as /devices/virtual/input/input174 [ 2743.289561][T26274] usb 9-1: config 0 descriptor?? [ 2743.324584][T26274] cdc_ether 9-1:0.0: More than one union descriptor, skipping ... [ 2743.344717][T26274] usb 9-1: bad CDC descriptors [ 2743.351594][T26274] usb 9-1: unsupported MDLM descriptors [ 2743.739070][ T30] audit: type=1400 audit(1755015961.831:42557): avc: denied { node_bind } for pid=8202 comm="syz.1.9163" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 2743.801607][ T30] audit: type=1400 audit(1755015961.831:42558): avc: denied { connect } for pid=8202 comm="syz.1.9163" lport=20002 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 2743.801883][T26273] usb 7-1: new high-speed USB device number 73 using dummy_hcd [ 2743.859995][ T8210] syz.7.9168 (8210): drop_caches: 2 [ 2744.024572][ T8233] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2744.127251][ T8231] No control pipe specified [ 2744.218237][ T8231] IPVS: set_ctl: invalid protocol: 47 172.20.20.170:20000 [ 2744.253563][T26273] usb 7-1: Using ep0 maxpacket: 16 [ 2744.260561][T26273] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2744.272868][T26273] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2744.333505][T26273] usb 7-1: config 0 interface 0 has no altsetting 0 [ 2744.370421][T26273] usb 7-1: New USB device found, idVendor=05ac, idProduct=0247, bcdDevice= 0.00 [ 2744.422559][T26273] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2744.468893][T26274] usb 9-1: USB disconnect, device number 72 [ 2744.492914][T26273] usb 7-1: config 0 descriptor?? [ 2744.835243][ T8241] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9173'. [ 2744.925858][ T8240] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8240 comm=syz.1.9174 [ 2745.675987][T26273] apple 0003:05AC:0247.003E: unknown main item tag 0x0 [ 2745.682854][T26273] apple 0003:05AC:0247.003E: unknown main item tag 0x0 [ 2745.692478][T26273] apple 0003:05AC:0247.003E: unknown main item tag 0x0 [ 2745.699830][T26273] apple 0003:05AC:0247.003E: unknown main item tag 0x0 [ 2745.711005][T26273] apple 0003:05AC:0247.003E: unknown main item tag 0x0 [ 2745.718309][T26273] apple 0003:05AC:0247.003E: unknown main item tag 0x0 [ 2745.725716][T26273] apple 0003:05AC:0247.003E: unknown main item tag 0x0 [ 2745.733055][T26273] apple 0003:05AC:0247.003E: unknown main item tag 0x0 [ 2745.741754][T26273] apple 0003:05AC:0247.003E: unknown main item tag 0x0 [ 2745.792112][T26273] apple 0003:05AC:0247.003E: unknown main item tag 0x0 [ 2745.823048][T26273] apple 0003:05AC:0247.003E: unexpected long global item [ 2745.834394][T26273] apple 0003:05AC:0247.003E: parse failed [ 2745.840923][T26273] apple 0003:05AC:0247.003E: probe with driver apple failed with error -22 [ 2745.891060][T26273] usb 7-1: USB disconnect, device number 73 [ 2746.311550][ T8256] netlink: 4 bytes leftover after parsing attributes in process `syz.6.9177'. [ 2746.663844][ T30] kauditd_printk_skb: 152 callbacks suppressed [ 2746.663858][ T30] audit: type=1400 audit(1755015966.411:42711): avc: denied { create } for pid=8246 comm="syz.6.9177" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 2746.772559][ T8250] netlink: 44 bytes leftover after parsing attributes in process `syz.1.9176'. [ 2746.955116][ T30] audit: type=1400 audit(1755015966.411:42712): avc: denied { ioctl } for pid=8246 comm="syz.6.9177" path="socket:[162307]" dev="sockfs" ino=162307 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 2747.006469][ T30] audit: type=1400 audit(1755015966.411:42713): avc: denied { write } for pid=8246 comm="syz.6.9177" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 2747.101248][ T30] audit: type=1400 audit(1755015966.431:42714): avc: denied { map_create } for pid=8246 comm="syz.6.9177" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2747.121676][ T30] audit: type=1400 audit(1755015966.431:42715): avc: denied { bpf } for pid=8246 comm="syz.6.9177" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2747.157056][ T30] audit: type=1400 audit(1755015966.431:42716): avc: denied { map_read map_write } for pid=8246 comm="syz.6.9177" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2747.558350][ T30] audit: type=1400 audit(1755015966.441:42717): avc: denied { create } for pid=8246 comm="syz.6.9177" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 2747.603715][ T8245] netlink: 44 bytes leftover after parsing attributes in process `syz.3.9175'. [ 2747.652584][ T8245] netlink: 43 bytes leftover after parsing attributes in process `syz.3.9175'. [ 2747.661889][ T8245] netlink: 'syz.3.9175': attribute type 6 has an invalid length. [ 2747.674353][ T8245] netlink: 43 bytes leftover after parsing attributes in process `syz.3.9175'. [ 2748.033672][ T30] audit: type=1400 audit(1755015966.441:42718): avc: denied { ioctl } for pid=8246 comm="syz.6.9177" path="socket:[162309]" dev="sockfs" ino=162309 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 2748.180017][ T30] audit: type=1400 audit(1755015966.451:42719): avc: denied { ioctl } for pid=8246 comm="syz.6.9177" path="/dev/video6" dev="devtmpfs" ino=938 ioctlcmd=0x5600 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 2748.268875][ T30] audit: type=1400 audit(1755015966.871:42720): avc: denied { write } for pid=8248 comm="syz.1.9176" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 2748.999243][ T8290] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8290 comm=syz.3.9187 [ 2749.158777][ T8291] netlink: 'syz.8.9186': attribute type 21 has an invalid length. [ 2749.177873][ T8291] netlink: 156 bytes leftover after parsing attributes in process `syz.8.9186'. [ 2749.349869][ T8292] netlink: 'syz.7.9185': attribute type 21 has an invalid length. [ 2749.393711][ T8292] netlink: 156 bytes leftover after parsing attributes in process `syz.7.9185'. [ 2750.634632][ T8304] tipc: Started in network mode [ 2750.639738][ T8304] tipc: Node identity baf5eea74d, cluster identity 4711 [ 2750.657814][ T8304] tipc: Enabled bearer , priority 0 [ 2750.723064][ T8306] syzkaller0: entered promiscuous mode [ 2750.803466][ T8306] syzkaller0: entered allmulticast mode [ 2750.885932][ T8301] tipc: Resetting bearer [ 2750.926205][ T8301] tipc: Disabling bearer [ 2751.357263][ T8317] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2751.529253][ T8316] team_slave_0: left promiscuous mode [ 2751.535244][ T8316] team_slave_1: left promiscuous mode [ 2751.623400][T26273] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 2751.793509][T26273] usb 2-1: Using ep0 maxpacket: 16 [ 2751.801472][T26273] usb 2-1: config 5 has too many interfaces: 33, using maximum allowed: 32 [ 2751.826955][T26273] usb 2-1: config 5 has an invalid descriptor of length 34, skipping remainder of the config [ 2751.847854][T26273] usb 2-1: config 5 has 0 interfaces, different from the descriptor's value: 33 [ 2751.859166][ T8316] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2751.866936][T26273] usb 2-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 2751.953828][ T8316] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2751.961314][T26273] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2751.972003][ T30] kauditd_printk_skb: 208 callbacks suppressed [ 2751.972017][ T30] audit: type=1400 audit(1755015972.071:42929): avc: denied { read write } for pid=4559 comm="syz-executor" name="loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2752.086993][ T30] audit: type=1400 audit(1755015972.111:42930): avc: denied { open } for pid=4559 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2752.116937][ T30] audit: type=1400 audit(1755015972.111:42931): avc: denied { ioctl } for pid=4559 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=653 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2752.146335][ T30] audit: type=1400 audit(1755015972.131:42932): avc: denied { ioctl } for pid=8310 comm="syz.1.9193" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x550a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2752.171818][ T30] audit: type=1400 audit(1755015972.191:42933): avc: denied { read write } for pid=7369 comm="syz-executor" name="loop7" dev="devtmpfs" ino=654 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2752.937765][ T30] audit: type=1400 audit(1755015972.191:42934): avc: denied { open } for pid=7369 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=654 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2753.039784][ T30] audit: type=1400 audit(1755015972.191:42935): avc: denied { ioctl } for pid=7369 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=654 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2753.069548][ T30] audit: type=1400 audit(1755015972.281:42936): avc: denied { prog_load } for pid=8320 comm="syz.6.9195" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2753.091445][ T30] audit: type=1400 audit(1755015972.281:42937): avc: denied { bpf } for pid=8320 comm="syz.6.9195" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2753.114050][ T30] audit: type=1400 audit(1755015972.301:42938): avc: denied { perfmon } for pid=8320 comm="syz.6.9195" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2753.190803][ T4590] netdevsim netdevsim8 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2753.287270][ T49] netdevsim netdevsim8 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2753.310488][ T4590] netdevsim netdevsim8 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2753.361895][ T4590] netdevsim netdevsim8 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2753.390516][ T8334] netlink: 44 bytes leftover after parsing attributes in process `syz.6.9197'. [ 2753.399745][ T8334] netlink: 43 bytes leftover after parsing attributes in process `syz.6.9197'. [ 2753.411790][ T8334] netlink: 'syz.6.9197': attribute type 6 has an invalid length. [ 2753.434329][ T8334] netlink: 43 bytes leftover after parsing attributes in process `syz.6.9197'. [ 2754.183758][ T6886] usb 2-1: USB disconnect, device number 99 [ 2754.257393][ T8344] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8344 comm=syz.8.9199 [ 2755.106792][ T8357] genirq: Flags mismatch irq 4. 00200000 (aio_iiro_16) vs. 00200080 (ttyS0) [ 2755.188781][ T8358] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9201'. [ 2755.287013][ T8358] netlink: 56 bytes leftover after parsing attributes in process `syz.1.9201'. [ 2757.059100][ T30] kauditd_printk_skb: 199 callbacks suppressed [ 2757.059118][ T30] audit: type=1400 audit(1755015977.071:43138): avc: denied { create } for pid=8377 comm="syz.1.9210" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 2757.086188][ T30] audit: type=1400 audit(1755015977.081:43139): avc: denied { create } for pid=8379 comm="syz.6.9211" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 2757.106185][ T30] audit: type=1400 audit(1755015977.081:43140): avc: denied { write } for pid=8377 comm="syz.1.9210" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 2757.583124][ T30] audit: type=1400 audit(1755015977.081:43141): avc: denied { nlmsg_write } for pid=8377 comm="syz.1.9210" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 2757.674456][ T30] audit: type=1400 audit(1755015977.081:43142): avc: denied { execmem } for pid=8379 comm="syz.6.9211" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 2757.833760][ T30] audit: type=1400 audit(1755015977.211:43143): avc: denied { read } for pid=8377 comm="syz.1.9210" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 2758.006972][ T30] audit: type=1400 audit(1755015977.211:43144): avc: denied { open } for pid=8377 comm="syz.1.9210" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 2758.031612][ T30] audit: type=1400 audit(1755015977.311:43145): avc: denied { create } for pid=8379 comm="syz.6.9211" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 2758.054176][ T30] audit: type=1400 audit(1755015977.311:43146): avc: denied { write } for pid=8379 comm="syz.6.9211" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 2758.288661][ T30] audit: type=1400 audit(1755015977.311:43147): avc: denied { nlmsg_write } for pid=8379 comm="syz.6.9211" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 2758.388671][ T8389] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8389 comm=syz.6.9213 [ 2758.930757][ T8392] lo speed is unknown, defaulting to 1000 [ 2760.070525][ T8413] netlink: 44 bytes leftover after parsing attributes in process `syz.8.9218'. [ 2760.166979][ T8413] netlink: 43 bytes leftover after parsing attributes in process `syz.8.9218'. [ 2760.177918][ T8413] netlink: 'syz.8.9218': attribute type 6 has an invalid length. [ 2760.185988][ T8413] netlink: 43 bytes leftover after parsing attributes in process `syz.8.9218'. [ 2760.297006][ T8408] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9217'. [ 2760.322160][ T8408] netlink: 19 bytes leftover after parsing attributes in process `syz.3.9217'. [ 2760.488752][ T8415] sp0: Synchronizing with TNC [ 2760.548315][ T8407] [U] è [ 2760.797301][ T8430] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9221'. [ 2761.025891][T21139] Bluetooth: hci3: command 0x0406 tx timeout [ 2761.572796][ T8441] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2762.104374][ T30] kauditd_printk_skb: 160 callbacks suppressed [ 2762.104389][ T30] audit: type=1400 audit(1755015982.211:43308): avc: denied { prog_load } for pid=8425 comm="syz.6.9222" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2762.158202][ T30] audit: type=1400 audit(1755015982.241:43309): avc: denied { bpf } for pid=8425 comm="syz.6.9222" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2762.252586][ T30] audit: type=1400 audit(1755015982.241:43310): avc: denied { perfmon } for pid=8425 comm="syz.6.9222" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2762.320633][ T30] audit: type=1400 audit(1755015982.241:43311): avc: denied { prog_run } for pid=8425 comm="syz.6.9222" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2762.350903][ T30] audit: type=1400 audit(1755015982.311:43312): avc: denied { read write } for pid=7078 comm="syz-executor" name="loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2762.425642][ T30] audit: type=1400 audit(1755015982.311:43313): avc: denied { open } for pid=7078 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2762.670687][ T8450] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 2763.050702][ T30] audit: type=1400 audit(1755015982.311:43314): avc: denied { ioctl } for pid=7078 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2763.229121][ T30] audit: type=1400 audit(1755015982.381:43315): avc: denied { watch watch_reads } for pid=8425 comm="syz.6.9222" path="/182" dev="tmpfs" ino=1005 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 2763.313629][ T30] audit: type=1400 audit(1755015982.501:43316): avc: denied { read write } for pid=6576 comm="syz-executor" name="loop8" dev="devtmpfs" ino=655 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2763.366762][ T30] audit: type=1400 audit(1755015982.501:43317): avc: denied { read write open } for pid=6576 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=655 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2764.039683][ T8456] lo speed is unknown, defaulting to 1000 [ 2766.101346][ T8469] bridge0: port 2(bridge_slave_1) entered disabled state [ 2766.108689][ T8469] bridge0: port 1(bridge_slave_0) entered disabled state [ 2766.149052][ T8469] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2766.159460][ T8469] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2766.229440][ T4590] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2766.241419][ T4590] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2766.251177][ T4590] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2766.320295][ T8483] netlink: 44 bytes leftover after parsing attributes in process `syz.1.9231'. [ 2766.333558][ T5886] usb 9-1: new high-speed USB device number 73 using dummy_hcd [ 2766.496088][ T4590] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2766.699050][ T5886] usb 9-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 2766.728568][ T5886] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 2766.775911][ T5886] usb 9-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2766.846382][ T8492] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2767.111280][ T5886] usb 9-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 2767.123520][ T5886] usb 9-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 2767.131533][ T30] kauditd_printk_skb: 149 callbacks suppressed [ 2767.131543][ T30] audit: type=1400 audit(1755015987.231:43467): avc: denied { perfmon } for pid=8493 comm="syz.1.9238" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2767.161843][ T5886] usb 9-1: Product: syz [ 2767.166062][ T5886] usb 9-1: Manufacturer: syz [ 2767.174086][ T8488] lo speed is unknown, defaulting to 1000 [ 2767.180508][ T30] audit: type=1400 audit(1755015987.231:43468): avc: denied { bpf } for pid=8493 comm="syz.1.9238" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2767.202481][ T5886] cdc_wdm 9-1:1.0: skipping garbage [ 2767.210250][ T5886] cdc_wdm 9-1:1.0: probe with driver cdc_wdm failed with error -22 [ 2767.226089][ T30] audit: type=1400 audit(1755015987.281:43469): avc: denied { ioctl } for pid=8479 comm="syz.8.9234" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x550a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2767.251030][ C0] vkms_vblank_simulate: vblank timer overrun [ 2767.261502][ T30] audit: type=1400 audit(1755015987.321:43470): avc: denied { read write } for pid=7078 comm="syz-executor" name="loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2767.286778][ C0] vkms_vblank_simulate: vblank timer overrun [ 2767.399253][ T30] audit: type=1400 audit(1755015987.321:43471): avc: denied { read write open } for pid=7078 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2767.659573][ T30] audit: type=1400 audit(1755015987.321:43472): avc: denied { ioctl } for pid=7078 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2767.685230][ C0] vkms_vblank_simulate: vblank timer overrun [ 2767.693813][ T8498] netlink: 45 bytes leftover after parsing attributes in process `syz.1.9240'. [ 2767.813603][ T30] audit: type=1400 audit(1755015987.401:43473): avc: denied { read } for pid=8495 comm="syz.6.9239" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 2767.836759][ T30] audit: type=1400 audit(1755015987.401:43474): avc: denied { open } for pid=8495 comm="syz.6.9239" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 2768.249185][ T8503] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2768.257796][ T8503] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2768.320102][ T30] audit: type=1400 audit(1755015987.411:43475): avc: denied { prog_load } for pid=8497 comm="syz.1.9240" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2768.465055][ T30] audit: type=1400 audit(1755015987.411:43476): avc: denied { bpf } for pid=8497 comm="syz.1.9240" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2768.583093][ T8511] overlayfs: missing 'lowerdir' [ 2769.580264][ T6886] usb 9-1: USB disconnect, device number 73 [ 2769.758078][ T8521] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2770.073471][ T3495] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 2770.278773][ T3495] usb 2-1: Using ep0 maxpacket: 16 [ 2770.285615][ T3495] usb 2-1: config 5 has too many interfaces: 33, using maximum allowed: 32 [ 2770.877203][ T3495] usb 2-1: config 5 has an invalid descriptor of length 34, skipping remainder of the config [ 2771.112626][ T3495] usb 2-1: config 5 has 0 interfaces, different from the descriptor's value: 33 [ 2771.124019][ T3495] usb 2-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 2771.163735][ T8533] netlink: 'syz.8.9246': attribute type 21 has an invalid length. [ 2771.173391][ T8533] netlink: 156 bytes leftover after parsing attributes in process `syz.8.9246'. [ 2771.232131][ T3495] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2771.398268][ T8537] lo speed is unknown, defaulting to 1000 [ 2772.140897][ T30] kauditd_printk_skb: 119 callbacks suppressed [ 2772.140909][ T30] audit: type=1400 audit(1755015992.241:43596): avc: denied { create } for pid=8543 comm="syz.6.9250" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 2772.377049][ T3495] usb 2-1: can't set config #5, error -71 [ 2772.379438][ T30] audit: type=1400 audit(1755015992.271:43597): avc: denied { write } for pid=8543 comm="syz.6.9250" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 2772.406320][ T30] audit: type=1400 audit(1755015992.441:43598): avc: denied { read write } for pid=7078 comm="syz-executor" name="loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2772.430740][ C0] vkms_vblank_simulate: vblank timer overrun [ 2772.435389][ T3495] usb 2-1: USB disconnect, device number 100 [ 2772.444640][ T30] audit: type=1400 audit(1755015992.441:43599): avc: denied { open } for pid=7078 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2772.744889][ T8554] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8554 comm=syz.3.9251 [ 2773.223960][ T30] audit: type=1400 audit(1755015992.441:43600): avc: denied { ioctl } for pid=7078 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2773.249603][ C0] vkms_vblank_simulate: vblank timer overrun [ 2773.256354][ T30] audit: type=1400 audit(1755015992.551:43601): avc: denied { read write } for pid=7369 comm="syz-executor" name="loop7" dev="devtmpfs" ino=654 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2773.280577][ C0] vkms_vblank_simulate: vblank timer overrun [ 2773.286772][ T30] audit: type=1400 audit(1755015992.551:43602): avc: denied { read write open } for pid=7369 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=654 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2773.311876][ C0] vkms_vblank_simulate: vblank timer overrun [ 2773.318331][ T30] audit: type=1400 audit(1755015992.551:43603): avc: denied { ioctl } for pid=7369 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=654 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2773.343976][ C0] vkms_vblank_simulate: vblank timer overrun [ 2773.350481][ T30] audit: type=1400 audit(1755015992.571:43604): avc: denied { read } for pid=8546 comm="syz.6.9252" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 2773.374469][ T30] audit: type=1400 audit(1755015992.571:43605): avc: denied { open } for pid=8546 comm="syz.6.9252" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 2773.398102][ C0] vkms_vblank_simulate: vblank timer overrun [ 2773.499974][ T8560] netlink: 'syz.7.9254': attribute type 2 has an invalid length. [ 2773.660971][ T8560] netlink: 4 bytes leftover after parsing attributes in process `syz.7.9254'. [ 2773.713590][ T5886] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 2774.096260][ T5886] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 2774.148292][ T5886] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 2774.167815][ T5886] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2774.202589][ T5886] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 2774.219891][ T5886] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 2774.260282][ T5886] usb 2-1: Product: syz [ 2774.268342][ T5886] usb 2-1: Manufacturer: syz [ 2774.293061][ T5886] cdc_wdm 2-1:1.0: skipping garbage [ 2774.315475][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 2774.321863][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 2774.360949][ T5886] cdc_wdm 2-1:1.0: probe with driver cdc_wdm failed with error -22 [ 2774.399789][ T8571] netlink: 112 bytes leftover after parsing attributes in process `syz.6.9258'. [ 2774.423244][ T8571] IPVS: set_ctl: invalid protocol: 33 0.0.0.0:20003 [ 2774.668623][ T8560] hsr_slave_1 (unregistering): left promiscuous mode [ 2774.758005][ T8575] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2774.769036][ T8575] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2774.864713][ T6886] usb 7-1: new high-speed USB device number 75 using dummy_hcd [ 2775.263536][ T6886] usb 7-1: Using ep0 maxpacket: 8 [ 2775.312823][ T6886] usb 7-1: config index 0 descriptor too short (expected 30, got 18) [ 2775.500372][ T6886] usb 7-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 2775.531353][ T6886] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2775.959153][ T6886] usb 7-1: Product: syz [ 2775.963520][ T6886] usb 7-1: Manufacturer: syz [ 2775.992518][ T6886] usb 7-1: SerialNumber: syz [ 2776.045947][ T6886] usb 7-1: config 0 descriptor?? [ 2776.110442][ T6886] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 2776.158888][ T6886] usb 7-1: setting power ON [ 2776.269688][ T6886] dvb-usb: bulk message failed: -22 (2/0) [ 2776.434263][ T6886] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2776.458501][ T6886] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 2776.467295][ T6886] usb 7-1: media controller created [ 2776.501329][ T6886] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2776.539008][T26245] usb 2-1: USB disconnect, device number 101 [ 2776.559035][ T6886] usb 7-1: selecting invalid altsetting 6 [ 2776.577969][ T6886] usb 7-1: digital interface selection failed (-22) [ 2776.593170][ T6886] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 2776.649689][ T6886] usb 7-1: setting power OFF [ 2776.668656][ T6886] dvb-usb: bulk message failed: -22 (2/0) [ 2776.787933][ T6886] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 2777.082963][ T6886] (NULL device *): no alternate interface [ 2777.148634][ T30] kauditd_printk_skb: 162 callbacks suppressed [ 2777.148650][ T30] audit: type=1400 audit(1755015997.251:43768): avc: denied { create } for pid=8593 comm="syz.7.9263" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 2777.724123][ T6886] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 2777.898800][ T30] audit: type=1400 audit(1755015997.291:43769): avc: denied { execmem } for pid=8589 comm="syz.1.9262" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 2777.928484][ T30] audit: type=1400 audit(1755015997.801:43770): avc: denied { write } for pid=8593 comm="syz.7.9263" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 2778.008134][ T8598] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2778.081877][ T30] audit: type=1400 audit(1755015997.861:43771): avc: denied { read write } for pid=7369 comm="syz-executor" name="loop7" dev="devtmpfs" ino=654 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2778.108409][ T30] audit: type=1400 audit(1755015997.861:43772): avc: denied { open } for pid=7369 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=654 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2778.135210][ T30] audit: type=1400 audit(1755015997.861:43773): avc: denied { ioctl } for pid=7369 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=654 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2778.160862][ C0] vkms_vblank_simulate: vblank timer overrun [ 2778.171176][ T30] audit: type=1400 audit(1755015997.921:43774): avc: denied { execmem } for pid=8595 comm="syz.7.9264" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 2778.268886][ T8603] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8603 comm=syz.1.9266 [ 2779.077679][ T30] audit: type=1400 audit(1755015998.051:43775): avc: denied { read write } for pid=6576 comm="syz-executor" name="loop8" dev="devtmpfs" ino=655 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2779.103740][ T30] audit: type=1400 audit(1755015998.051:43776): avc: denied { open } for pid=7078 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2779.127907][ C0] vkms_vblank_simulate: vblank timer overrun [ 2779.134018][ T30] audit: type=1400 audit(1755015998.051:43777): avc: denied { ioctl } for pid=7078 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2779.157351][ T5886] usb 7-1: USB disconnect, device number 75 [ 2779.159658][ C0] vkms_vblank_simulate: vblank timer overrun [ 2780.108086][ T8624] netlink: 4 bytes leftover after parsing attributes in process `syz.6.9270'. [ 2781.155237][ T8618] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 2782.266000][ T30] kauditd_printk_skb: 127 callbacks suppressed [ 2782.266015][ T30] audit: type=1400 audit(1755016002.361:43905): avc: denied { read write } for pid=4559 comm="syz-executor" name="loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2782.368134][ T8636] random: crng reseeded on system resumption [ 2782.369020][ T30] audit: type=1400 audit(1755016002.371:43906): avc: denied { open } for pid=7590 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=650 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2782.658968][ T30] audit: type=1400 audit(1755016002.371:43907): avc: denied { ioctl } for pid=7590 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=650 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2783.546630][ T30] audit: type=1400 audit(1755016002.411:43908): avc: denied { read write open } for pid=4559 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2783.729851][ T30] audit: type=1400 audit(1755016002.411:43909): avc: denied { ioctl } for pid=4559 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=653 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2783.777509][ T30] audit: type=1400 audit(1755016002.471:43910): avc: denied { write } for pid=8635 comm="syz.6.9275" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 2784.040862][ T30] audit: type=1400 audit(1755016002.471:43911): avc: denied { open } for pid=8635 comm="syz.6.9275" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 2784.164699][ T30] audit: type=1400 audit(1755016002.491:43912): avc: denied { firmware_load } for pid=49 comm="kworker/u8:3" path="/lib/firmware/regulatory.db" dev="sda1" ino=448 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 2784.209152][ T6576] audit: audit_backlog=65 > audit_backlog_limit=64 [ 2784.300356][ T7078] audit: audit_backlog=65 > audit_backlog_limit=64 [ 2784.342825][ T8654] netlink: 'syz.1.9281': attribute type 1 has an invalid length. [ 2784.406202][ T8656] netlink: 4 bytes leftover after parsing attributes in process `syz.6.9278'. [ 2785.134839][ T8654] 8021q: adding VLAN 0 to HW filter on device bond1 [ 2785.172151][ T6886] IPVS: starting estimator thread 0... [ 2785.311450][ T8654] bond1: (slave gretap1): making interface the new active one [ 2785.838990][ T8654] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 2785.853440][ T8668] IPVS: using max 41 ests per chain, 98400 per kthread [ 2786.713526][T21139] Bluetooth: hci4: command 0x0406 tx timeout [ 2787.280324][ T30] kauditd_printk_skb: 173 callbacks suppressed [ 2787.280339][ T30] audit: type=1400 audit(1755016007.381:44073): avc: denied { read write } for pid=4559 comm="syz-executor" name="loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2787.331631][ T30] audit: type=1400 audit(1755016007.391:44074): avc: denied { read } for pid=8687 comm="syz.8.9288" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 2787.356585][ T30] audit: type=1400 audit(1755016007.391:44075): avc: denied { open } for pid=8687 comm="syz.8.9288" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 2787.471356][ T30] audit: type=1400 audit(1755016007.421:44076): avc: denied { read write open } for pid=4559 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2787.563673][ T30] audit: type=1400 audit(1755016007.421:44077): avc: denied { ioctl } for pid=4559 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=653 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2787.622922][ T30] audit: type=1400 audit(1755016007.431:44078): avc: denied { create } for pid=8687 comm="syz.8.9288" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 2787.666838][ T8697] netlink: 212408 bytes leftover after parsing attributes in process `syz.8.9288'. [ 2787.677971][ T8697] netlink: zone id is out of range [ 2787.683104][ T8697] netlink: zone id is out of range [ 2787.692194][ T30] audit: type=1400 audit(1755016007.481:44079): avc: denied { execmem } for pid=8689 comm="syz.1.9289" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 2787.718800][ T8697] netlink: get zone limit has 8 unknown bytes [ 2787.725487][ T30] audit: type=1400 audit(1755016007.541:44080): avc: denied { read write } for pid=8684 comm="syz.7.9287" name="vhost-vsock" dev="devtmpfs" ino=1275 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 2787.752234][ T30] audit: type=1400 audit(1755016007.541:44081): avc: denied { open } for pid=8684 comm="syz.7.9287" path="/dev/vhost-vsock" dev="devtmpfs" ino=1275 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 2787.904863][ T30] audit: type=1400 audit(1755016007.601:44082): avc: denied { prog_load } for pid=8689 comm="syz.1.9289" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2788.423665][ T8718] netlink: 174844 bytes leftover after parsing attributes in process `syz.3.9295'. [ 2788.435271][ T8718] netlink: zone id is out of range [ 2788.440401][ T8718] netlink: zone id is out of range [ 2788.455316][ T8718] netlink: zone id is out of range [ 2788.460648][ T8718] netlink: zone id is out of range [ 2788.491814][ T8718] netlink: zone id is out of range [ 2788.505165][ T3495] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 2788.513821][ T8718] netlink: zone id is out of range [ 2788.519512][ T8718] netlink: zone id is out of range [ 2788.733464][ T3495] usb 2-1: Using ep0 maxpacket: 16 [ 2788.741875][ T3495] usb 2-1: config 5 has too many interfaces: 33, using maximum allowed: 32 [ 2788.751357][ T3495] usb 2-1: config 5 has an invalid descriptor of length 34, skipping remainder of the config [ 2788.765358][ T3495] usb 2-1: config 5 has 0 interfaces, different from the descriptor's value: 33 [ 2788.777306][ T3495] usb 2-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 2788.959011][ T3495] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2788.963244][ T8720] netlink: 44 bytes leftover after parsing attributes in process `syz.8.9296'. [ 2788.976118][ T8720] netlink: 43 bytes leftover after parsing attributes in process `syz.8.9296'. [ 2789.100781][ T8720] netlink: 'syz.8.9296': attribute type 6 has an invalid length. [ 2789.116218][ T8720] netlink: 43 bytes leftover after parsing attributes in process `syz.8.9296'. [ 2789.169646][ T8726] netlink: 'syz.3.9297': attribute type 2 has an invalid length. [ 2789.451923][ T8724] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9297'. [ 2789.523452][ T3495] usb 7-1: new high-speed USB device number 76 using dummy_hcd [ 2789.748619][ T3495] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2789.759286][ T3495] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2789.796190][ T3495] usb 7-1: Product: syz [ 2789.896403][ T3495] usb 7-1: Manufacturer: syz [ 2789.901522][ T3495] usb 7-1: SerialNumber: syz [ 2790.810404][T26274] usb 2-1: USB disconnect, device number 102 [ 2791.031125][ T3495] cdc_ncm 7-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 2791.045751][ T3495] cdc_ncm 7-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 2791.053402][ T3495] cdc_ncm 7-1:1.0: setting rx_max = 2048 [ 2791.651550][ T8754] netlink: 4 bytes leftover after parsing attributes in process `syz.7.9305'. [ 2792.328550][ T30] kauditd_printk_skb: 233 callbacks suppressed [ 2792.328577][ T30] audit: type=1400 audit(1755016012.431:44316): avc: denied { ioctl } for pid=8753 comm="syz.1.9307" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2792.433689][T26274] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 2792.607619][ T30] audit: type=1400 audit(1755016012.441:44317): avc: denied { read write } for pid=7369 comm="syz-executor" name="loop7" dev="devtmpfs" ino=654 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2792.677048][ T30] audit: type=1400 audit(1755016012.441:44318): avc: denied { open } for pid=7369 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=654 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2792.706252][ T30] audit: type=1400 audit(1755016012.441:44319): avc: denied { ioctl } for pid=7369 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=654 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2792.783432][T26274] usb 2-1: Using ep0 maxpacket: 8 [ 2792.791834][T26274] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2792.818985][T26274] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2792.860641][T26274] usb 2-1: New USB device found, idVendor=046a, idProduct=0027, bcdDevice= 0.00 [ 2792.871570][ T30] audit: type=1400 audit(1755016012.491:44320): avc: denied { ioctl } for pid=8753 comm="syz.1.9307" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 2792.897138][ T30] audit: type=1400 audit(1755016012.501:44321): avc: denied { read } for pid=8756 comm="syz.3.9306" dev="nsfs" ino=4026533351 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 2792.918436][T26274] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2792.928457][ T30] audit: type=1400 audit(1755016012.501:44322): avc: denied { open } for pid=8756 comm="syz.3.9306" path="net:[4026533351]" dev="nsfs" ino=4026533351 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 2792.955227][ T8764] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2792.960404][T26274] usb 2-1: config 0 descriptor?? [ 2793.019380][ T30] audit: type=1400 audit(1755016012.511:44323): avc: denied { create } for pid=8756 comm="syz.3.9306" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 2793.052236][ T30] audit: type=1400 audit(1755016012.511:44324): avc: denied { bind } for pid=8756 comm="syz.3.9306" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 2793.088360][ T30] audit: type=1400 audit(1755016012.511:44325): avc: denied { write } for pid=8756 comm="syz.3.9306" path="socket:[164251]" dev="sockfs" ino=164251 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 2793.178324][ T8766] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9310'. [ 2793.211652][ T8771] netlink: 8 bytes leftover after parsing attributes in process `syz.7.9308'. [ 2793.220839][T23241] usb 9-1: new high-speed USB device number 74 using dummy_hcd [ 2793.348614][ T8771] netlink: 56 bytes leftover after parsing attributes in process `syz.7.9308'. [ 2793.393512][T23241] usb 9-1: Using ep0 maxpacket: 16 [ 2793.404493][T23241] usb 9-1: config 5 has too many interfaces: 33, using maximum allowed: 32 [ 2793.420494][ T3495] cdc_ncm 7-1:1.0: setting tx_max = 184 [ 2793.430368][T23241] usb 9-1: config 5 has an invalid descriptor of length 34, skipping remainder of the config [ 2793.449757][ T3495] cdc_ncm 7-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.6-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 2793.465868][ T3495] usb 7-1: USB disconnect, device number 76 [ 2793.472980][ T3495] cdc_ncm 7-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.6-1, CDC NCM (NO ZLP) [ 2793.637822][ T8755] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 2793.767483][T23241] usb 9-1: config 5 has 0 interfaces, different from the descriptor's value: 33 [ 2793.853359][T23241] usb 9-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 2793.862548][T23241] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2794.017131][ T8775] lo speed is unknown, defaulting to 1000 [ 2794.390544][ T8780] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 2795.342289][T26274] usb 2-1: string descriptor 0 read error: -71 [ 2795.383472][T26274] hub 2-1:0.0: bad descriptor, ignoring hub [ 2795.389452][T26274] hub 2-1:0.0: probe with driver hub failed with error -5 [ 2795.451606][T26274] usb 2-1: USB disconnect, device number 103 [ 2795.740741][T23241] usb 9-1: USB disconnect, device number 74 [ 2796.029984][ T8792] dlm: no locking on control device [ 2796.272497][ T8795] netlink: 4 bytes leftover after parsing attributes in process `syz.8.9316'. [ 2796.780658][ T8806] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9319'. [ 2797.469766][ T30] kauditd_printk_skb: 160 callbacks suppressed [ 2797.469777][ T30] audit: type=1400 audit(1755016016.911:44486): avc: denied { map_read map_write } for pid=8800 comm="syz.3.9319" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2797.586099][ T30] audit: type=1400 audit(1755016016.921:44487): avc: denied { write } for pid=8800 comm="syz.3.9319" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 2798.220583][ T30] audit: type=1400 audit(1755016016.931:44488): avc: denied { create } for pid=8800 comm="syz.3.9319" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 2798.250210][ T30] audit: type=1400 audit(1755016016.931:44489): avc: denied { ioctl } for pid=8800 comm="syz.3.9319" path="socket:[163604]" dev="sockfs" ino=163604 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 2798.292104][ T30] audit: type=1400 audit(1755016017.371:44490): avc: denied { read } for pid=8802 comm="syz.1.9320" dev="nsfs" ino=4026533014 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 2798.313354][ C0] vkms_vblank_simulate: vblank timer overrun [ 2798.355030][ T30] audit: type=1400 audit(1755016017.371:44491): avc: denied { open } for pid=8802 comm="syz.1.9320" path="net:[4026533014]" dev="nsfs" ino=4026533014 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 2798.384379][ T30] audit: type=1400 audit(1755016017.381:44492): avc: denied { create } for pid=8802 comm="syz.1.9320" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 2798.410124][ T30] audit: type=1400 audit(1755016017.391:44493): avc: denied { bind } for pid=8802 comm="syz.1.9320" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 2798.430700][ C0] vkms_vblank_simulate: vblank timer overrun [ 2798.463441][ T8823] random: crng reseeded on system resumption [ 2798.603462][T23241] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 2798.699560][ T30] audit: type=1400 audit(1755016017.391:44494): avc: denied { write } for pid=8802 comm="syz.1.9320" path="socket:[164346]" dev="sockfs" ino=164346 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 2799.676382][ T8830] audit: audit_backlog=65 > audit_backlog_limit=64 [ 2800.173565][T23241] usb 2-1: Using ep0 maxpacket: 32 [ 2800.252387][ T8834] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2800.446964][ T8818] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2800.471494][ T8818] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2800.503554][ T3495] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 2800.574109][T23241] usb 2-1: unable to get BOS descriptor or descriptor too short [ 2800.635936][T23241] usb 2-1: no configurations [ 2800.645954][T23241] usb 2-1: can't read configurations, error -22 [ 2800.793600][T31582] usb 9-1: new high-speed USB device number 75 using dummy_hcd [ 2800.903516][ T3495] usb 4-1: Using ep0 maxpacket: 16 [ 2800.915154][ T3495] usb 4-1: config 5 has too many interfaces: 33, using maximum allowed: 32 [ 2800.940515][ T3495] usb 4-1: config 5 has an invalid descriptor of length 34, skipping remainder of the config [ 2800.952750][ T3495] usb 4-1: config 5 has 0 interfaces, different from the descriptor's value: 33 [ 2800.963353][ T3495] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 2800.972603][ T3495] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2800.973365][T31582] usb 9-1: Using ep0 maxpacket: 32 [ 2801.279034][ T8846] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 2801.868354][ T8857] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2801.880038][ T8857] 8021q: adding VLAN 0 to HW filter on device team0 [ 2802.432712][ T3495] usb 4-1: USB disconnect, device number 83 [ 2802.463399][ T8857] net_ratelimit: 1 callbacks suppressed [ 2802.463408][ T8857] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 2802.719579][ T30] kauditd_printk_skb: 178 callbacks suppressed [ 2802.719590][ T30] audit: type=1400 audit(1755016022.821:44668): avc: denied { read write } for pid=7369 comm="syz-executor" name="loop7" dev="devtmpfs" ino=654 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2802.851222][ T30] audit: type=1400 audit(1755016022.861:44669): avc: denied { read write } for pid=7590 comm="syz-executor" name="loop3" dev="devtmpfs" ino=650 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2802.892198][ T30] audit: type=1400 audit(1755016022.861:44670): avc: denied { open } for pid=7590 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=650 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2802.931274][ T30] audit: type=1400 audit(1755016022.861:44671): avc: denied { ioctl } for pid=7590 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=650 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2802.984401][ T30] audit: type=1400 audit(1755016022.861:44672): avc: denied { read write } for pid=7078 comm="syz-executor" name="loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2803.249625][ T8871] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9333'. [ 2804.879448][ T30] audit: type=1400 audit(1755016022.861:44673): avc: denied { open } for pid=7078 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2805.012255][ T30] audit: type=1400 audit(1755016022.861:44674): avc: denied { ioctl } for pid=7078 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2805.043861][ T30] audit: type=1400 audit(1755016022.871:44675): avc: denied { read write open } for pid=7369 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=654 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2805.073472][ T30] audit: type=1400 audit(1755016022.871:44676): avc: denied { ioctl } for pid=7369 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=654 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2805.103448][ T30] audit: type=1400 audit(1755016022.901:44677): avc: denied { prog_load } for pid=8841 comm="syz.8.9329" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2805.421220][ T8880] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9336'. [ 2806.230038][T31582] usb 9-1: unable to get BOS descriptor or descriptor too short [ 2806.251711][T31582] usb 9-1: no configurations [ 2806.283513][T31582] usb 9-1: can't read configurations, error -22 [ 2806.581594][T31582] usb 9-1: new high-speed USB device number 76 using dummy_hcd [ 2806.789721][ T8884] lo speed is unknown, defaulting to 1000 [ 2806.903504][T31582] usb 9-1: device descriptor read/64, error -32 [ 2807.024312][T31582] usb usb9-port1: attempt power cycle [ 2807.171914][ T4072] Bluetooth: hci0: command 0x0406 tx timeout [ 2808.596257][ T8890] netlink: 44 bytes leftover after parsing attributes in process `syz.7.9340'. [ 2808.656550][ T30] kauditd_printk_skb: 109 callbacks suppressed [ 2808.656561][ T30] audit: type=1400 audit(1755016027.381:44787): avc: denied { mounton } for pid=8889 comm="syz.7.9340" path="/72/bus" dev="tmpfs" ino=415 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 2808.757352][ T30] audit: type=1400 audit(1755016027.391:44788): avc: denied { unlink } for pid=8889 comm="syz.7.9340" name="#e1" dev="tmpfs" ino=419 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 2808.884053][ T30] audit: type=1400 audit(1755016027.391:44789): avc: denied { mount } for pid=8889 comm="syz.7.9340" name="/" dev="overlay" ino=414 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 2809.003357][ T30] audit: type=1400 audit(1755016028.701:44790): avc: denied { write } for pid=8889 comm="syz.7.9340" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 2809.115105][ T30] audit: type=1400 audit(1755016029.221:44791): avc: denied { read write } for pid=7590 comm="syz-executor" name="loop3" dev="devtmpfs" ino=650 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2809.173618][ T30] audit: type=1400 audit(1755016029.241:44792): avc: denied { read write open } for pid=7590 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=650 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2809.199239][ T30] audit: type=1400 audit(1755016029.241:44793): avc: denied { ioctl } for pid=7590 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=650 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2809.399141][ T30] audit: type=1400 audit(1755016029.261:44794): avc: denied { unmount } for pid=7369 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 2809.473364][T31582] usb 9-1: new high-speed USB device number 77 using dummy_hcd [ 2809.783594][T31582] usb 9-1: device descriptor read/8, error -32 [ 2809.870209][ T30] audit: type=1400 audit(1755016029.351:44795): avc: denied { create } for pid=8895 comm="syz.3.9341" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 2809.956502][ T30] audit: type=1400 audit(1755016029.371:44796): avc: denied { ioctl } for pid=8895 comm="syz.3.9341" path="socket:[164486]" dev="sockfs" ino=164486 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 2810.154704][T31582] usb 9-1: new high-speed USB device number 78 using dummy_hcd [ 2810.256593][ T8904] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2810.342027][T31582] usb 9-1: device descriptor read/8, error -32 [ 2810.513995][T31582] usb usb9-port1: unable to enumerate USB device [ 2812.008593][ T8927] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9349'. [ 2813.277116][ T8956] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2813.751042][ T6036] Bluetooth: (null): Too short H5 packet [ 2813.927188][ T30] kauditd_printk_skb: 239 callbacks suppressed [ 2813.927199][ T30] audit: type=1400 audit(1755016034.031:45034): avc: denied { read write } for pid=7078 comm="syz-executor" name="loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2813.968487][ T6036] Bluetooth: (null): Invalid header checksum [ 2813.975847][ T6036] Bluetooth: (null): Invalid header checksum [ 2813.981892][ T6036] Bluetooth: (null): Invalid header checksum [ 2814.009385][ T6036] Bluetooth: (null): Invalid header checksum [ 2814.034205][ T30] audit: type=1400 audit(1755016034.061:45035): avc: denied { read write open } for pid=7078 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2814.126614][ T30] audit: type=1400 audit(1755016034.061:45036): avc: denied { ioctl } for pid=7078 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2814.169370][T26539] Bluetooth: (null): Invalid header checksum [ 2814.427891][ T8967] lo speed is unknown, defaulting to 1000 [ 2814.465968][ T30] audit: type=1400 audit(1755016034.071:45037): avc: denied { read write } for pid=7590 comm="syz-executor" name="loop3" dev="devtmpfs" ino=650 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2814.522892][ T30] audit: type=1400 audit(1755016034.071:45038): avc: denied { open } for pid=7590 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=650 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2814.557711][ T30] audit: type=1400 audit(1755016034.071:45039): avc: denied { ioctl } for pid=7590 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=650 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 2814.660407][ T30] audit: type=1400 audit(1755016034.121:45040): avc: denied { prog_load } for pid=8963 comm="syz.1.9360" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2814.682959][ T30] audit: type=1400 audit(1755016034.121:45041): avc: denied { bpf } for pid=8963 comm="syz.1.9360" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2814.707739][ T30] audit: type=1400 audit(1755016034.131:45042): avc: denied { perfmon } for pid=8963 comm="syz.1.9360" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2814.731614][ T30] audit: type=1400 audit(1755016034.131:45043): avc: denied { prog_run } for pid=8963 comm="syz.1.9360" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2815.143993][ T8977] netlink: 112 bytes leftover after parsing attributes in process `syz.7.9362'. [ 2815.387499][ T8977] IPVS: set_ctl: invalid protocol: 33 0.0.0.0:20003 [ 2815.629199][ T8990] FAULT_INJECTION: forcing a failure. [ 2815.629199][ T8990] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2815.693156][ T8990] CPU: 1 UID: 0 PID: 8990 Comm: syz.3.9366 Not tainted 6.17.0-rc1-syzkaller-00004-g53e760d89498 #0 PREEMPT(full) [ 2815.693175][ T8990] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2815.693183][ T8990] Call Trace: [ 2815.693187][ T8990] [ 2815.693193][ T8990] dump_stack_lvl+0x16c/0x1f0 [ 2815.693208][ T8990] should_fail_ex+0x512/0x640 [ 2815.693222][ T8990] _copy_to_iter+0x29f/0x16f0 [ 2815.693239][ T8990] ? chacha_block_generic+0x211/0x330 [ 2815.693260][ T8990] ? __pfx__copy_to_iter+0x10/0x10 [ 2815.693283][ T8990] ? lockdep_hardirqs_on+0x7c/0x110 [ 2815.693299][ T8990] ? crng_make_state+0x48e/0x6d0 [ 2815.693324][ T8990] get_random_bytes_user+0x17f/0x3c0 [ 2815.693346][ T8990] ? __pfx_get_random_bytes_user+0x10/0x10 [ 2815.693365][ T8990] ? ksys_write+0x190/0x250 [ 2815.693385][ T8990] ? __mutex_unlock_slowpath+0x163/0x800 [ 2815.693412][ T8990] ? import_ubuf+0x1b6/0x220 [ 2815.693434][ T8990] __x64_sys_getrandom+0x183/0x290 [ 2815.693456][ T8990] ? __pfx___x64_sys_getrandom+0x10/0x10 [ 2815.693493][ T8990] do_syscall_64+0xcd/0x4c0 [ 2815.693514][ T8990] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2815.693531][ T8990] RIP: 0033:0x7ffa9bf8ebe9 [ 2815.693547][ T8990] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2815.693563][ T8990] RSP: 002b:00007ffa9ceb6038 EFLAGS: 00000246 ORIG_RAX: 000000000000013e [ 2815.693580][ T8990] RAX: ffffffffffffffda RBX: 00007ffa9c1b5fa0 RCX: 00007ffa9bf8ebe9 [ 2815.693592][ T8990] RDX: 0000000000000002 RSI: fffffffffffffdde RDI: 0000200000000040 [ 2815.693603][ T8990] RBP: 00007ffa9ceb6090 R08: 0000000000000000 R09: 0000000000000000 [ 2815.693614][ T8990] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2815.693624][ T8990] R13: 00007ffa9c1b6038 R14: 00007ffa9c1b5fa0 R15: 00007ffc30cc4b88 [ 2815.693649][ T8990] [ 2816.110579][ T8996] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 2816.121706][ T8996] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 2816.821092][ T8997] netlink: 44 bytes leftover after parsing attributes in process `syz.8.9365'. [ 2816.830278][ T8997] netlink: 43 bytes leftover after parsing attributes in process `syz.8.9365'. [ 2816.839372][ T8997] netlink: 'syz.8.9365': attribute type 6 has an invalid length. [ 2816.847232][ T8997] netlink: 43 bytes leftover after parsing attributes in process `syz.8.9365'. [ 2817.549060][T23241] IPVS: starting estimator thread 0... [ 2817.643426][ T9009] IPVS: using max 76 ests per chain, 182400 per kthread [ 2818.341606][ T9024] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 2818.353025][ T9024] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 2819.080319][ T30] kauditd_printk_skb: 247 callbacks suppressed [ 2819.080336][ T30] audit: type=1400 audit(1755016038.981:45291): avc: denied { read } for pid=9017 comm="syz.7.9374" dev="nsfs" ino=4026532972 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 2819.210196][ T30] audit: type=1400 audit(1755016038.981:45292): avc: denied { open } for pid=9017 comm="syz.7.9374" path="net:[4026532972]" dev="nsfs" ino=4026532972 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 2819.249330][ T30] audit: type=1400 audit(1755016038.981:45293): avc: denied { create } for pid=9017 comm="syz.7.9374" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 2819.277713][ T9026] ------------[ cut here ]------------ [ 2819.283172][ T9026] kernel BUG at ./include/linux/pagemap.h:1398! [ 2819.292383][ T9026] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 2819.298809][ T9026] CPU: 0 UID: 0 PID: 9026 Comm: syz.3.9373 Not tainted 6.17.0-rc1-syzkaller-00004-g53e760d89498 #0 PREEMPT(full) [ 2819.310771][ T9026] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2819.320811][ T9026] RIP: 0010:mpage_readahead+0x399/0x590 [ 2819.326350][ T9026] Code: 24 84 c0 74 08 3c 03 0f 8e 61 01 00 00 44 8b 7b 20 89 ef 44 89 fe e8 b6 ac 72 ff 41 39 ef 0f 83 9f fd ff ff e8 28 b2 72 ff 90 <0f> 0b e8 20 b2 72 ff 4c 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 [ 2819.345949][ T9026] RSP: 0018:ffffc9000b777310 EFLAGS: 00010283 [ 2819.351997][ T9026] RAX: 0000000000055e2a RBX: ffffc9000b777800 RCX: ffffc9000d329000 [ 2819.359949][ T9026] RDX: 0000000000080000 RSI: ffffffff8248e0f8 RDI: 0000000000000004 [ 2819.367900][ T9026] RBP: 0000000000000010 R08: 0000000000000004 R09: 0000000000000010 [ 2819.375849][ T9026] R10: 0000000000000001 R11: 0000000000000000 R12: dffffc0000000000 [ 2819.383794][ T9026] R13: ffffc9000b777824 R14: fffff520016eef04 R15: 0000000000000001 [ 2819.391743][ T9026] FS: 00007ffa9ce746c0(0000) GS:ffff8881246bc000(0000) knlGS:0000000000000000 [ 2819.400664][ T9026] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2819.407224][ T9026] CR2: 0000200000000280 CR3: 000000004a4b4000 CR4: 00000000003526f0 [ 2819.415188][ T9026] Call Trace: [ 2819.418445][ T9026] [ 2819.421354][ T9026] ? __pfx_mpage_readahead+0x10/0x10 [ 2819.426634][ T9026] ? __pfx_blkdev_get_block+0x10/0x10 [ 2819.431991][ T9026] ? folio_batch_move_lru+0x2c3/0x3b0 [ 2819.437354][ T9026] ? __pfx_lru_add+0x10/0x10 [ 2819.441930][ T9026] ? __pfx_blkdev_readahead+0x10/0x10 [ 2819.447285][ T9026] read_pages+0x1c1/0xc70 [ 2819.451602][ T9026] ? __pfx_read_pages+0x10/0x10 [ 2819.456454][ T9026] page_cache_ra_unbounded+0x421/0x7d0 [ 2819.461901][ T9026] force_page_cache_ra+0x246/0x340 [ 2819.466991][ T9026] page_cache_sync_ra+0x110/0xa00 [ 2819.471993][ T9026] filemap_get_pages+0xb62/0x1c20 [ 2819.477002][ T9026] ? __pfx_filemap_get_pages+0x10/0x10 [ 2819.482442][ T9026] ? __pfx___might_resched+0x10/0x10 [ 2819.487721][ T9026] ? lockdep_hardirqs_on+0x7c/0x110 [ 2819.492900][ T9026] filemap_splice_read+0x5cb/0xd60 [ 2819.497994][ T9026] ? __pfx_filemap_splice_read+0x10/0x10 [ 2819.503618][ T9026] ? __pfx_pipe_lock_cmp_fn+0x10/0x10 [ 2819.508972][ T9026] ? __pfx_filemap_splice_read+0x10/0x10 [ 2819.514607][ T9026] do_splice_read+0x282/0x370 [ 2819.519280][ T9026] splice_direct_to_actor+0x2a1/0xa30 [ 2819.524628][ T9026] ? __pfx_direct_splice_actor+0x10/0x10 [ 2819.530240][ T9026] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 2819.536112][ T9026] do_splice_direct+0x174/0x240 [ 2819.540957][ T9026] ? __pfx_do_splice_direct+0x10/0x10 [ 2819.546307][ T9026] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 2819.552176][ T9026] ? bpf_lsm_file_permission+0x9/0x10 [ 2819.557528][ T9026] ? security_file_permission+0x71/0x210 [ 2819.563143][ T9026] ? rw_verify_area+0xcf/0x6c0 [ 2819.567894][ T9026] do_sendfile+0xb06/0xe50 [ 2819.572289][ T9026] ? __pfx_do_sendfile+0x10/0x10 [ 2819.577203][ T9026] ? __x64_sys_futex+0x1e0/0x4c0 [ 2819.582125][ T9026] ? __x64_sys_futex+0x1e9/0x4c0 [ 2819.587045][ T9026] __x64_sys_sendfile64+0x1d8/0x220 [ 2819.592222][ T9026] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 2819.597926][ T9026] do_syscall_64+0xcd/0x4c0 [ 2819.602409][ T9026] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2819.608276][ T9026] RIP: 0033:0x7ffa9bf8ebe9 [ 2819.612668][ T9026] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2819.632266][ T9026] RSP: 002b:00007ffa9ce74038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 2819.640658][ T9026] RAX: ffffffffffffffda RBX: 00007ffa9c1b6180 RCX: 00007ffa9bf8ebe9 [ 2819.648614][ T9026] RDX: 0000000000000000 RSI: 000000000000000c RDI: 000000000000000c [ 2819.656573][ T9026] RBP: 00007ffa9c011e19 R08: 0000000000000000 R09: 0000000000000000 [ 2819.664532][ T9026] R10: 000000000020003f R11: 0000000000000246 R12: 0000000000000000 [ 2819.672492][ T9026] R13: 00007ffa9c1b6218 R14: 00007ffa9c1b6180 R15: 00007ffc30cc4b88 [ 2819.680459][ T9026] [ 2819.683461][ T9026] Modules linked in: [ 2819.687396][ C0] vkms_vblank_simulate: vblank timer overrun [ 2819.693712][ T9026] ---[ end trace 0000000000000000 ]--- [ 2819.700808][ T30] audit: type=1400 audit(1755016038.991:45294): avc: denied { bind } for pid=9017 comm="syz.7.9374" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 2819.713330][ T9026] RIP: 0010:mpage_readahead+0x399/0x590 [ 2819.720593][ C0] vkms_vblank_simulate: vblank timer overrun [ 2819.732287][ T9026] Code: 24 84 c0 74 08 3c 03 0f 8e 61 01 00 00 44 8b 7b 20 89 ef 44 89 fe e8 b6 ac 72 ff 41 39 ef 0f 83 9f fd ff ff e8 28 b2 72 ff 90 <0f> 0b e8 20 b2 72 ff 4c 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 [ 2819.737463][ T30] audit: type=1400 audit(1755016038.991:45295): avc: denied { write } for pid=9017 comm="syz.7.9374" path="socket:[164731]" dev="sockfs" ino=164731 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 2819.775891][ C0] vkms_vblank_simulate: vblank timer overrun [ 2819.782257][ T9026] RSP: 0018:ffffc9000b777310 EFLAGS: 00010283 [ 2819.788617][ T9026] RAX: 0000000000055e2a RBX: ffffc9000b777800 RCX: ffffc9000d329000 [ 2819.796841][ T9026] RDX: 0000000000080000 RSI: ffffffff8248e0f8 RDI: 0000000000000004 [ 2819.807859][ T9026] RBP: 0000000000000010 R08: 0000000000000004 R09: 0000000000000010 [ 2819.816761][ T9036] netlink: 12 bytes leftover after parsing attributes in process `syz.6.9377'. [ 2819.843537][ T9026] R10: 0000000000000001 R11: 0000000000000000 R12: dffffc0000000000 [ 2819.845070][ T30] audit: type=1400 audit(1755016039.211:45296): avc: denied { prog_load } for pid=9018 comm="syz.3.9373" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 2819.870641][ C0] vkms_vblank_simulate: vblank timer overrun [ 2819.879672][ T30] audit: type=1400 audit(1755016039.211:45297): avc: denied { bpf } for pid=9018 comm="syz.3.9373" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2819.903470][ T30] audit: type=1400 audit(1755016039.211:45298): avc: denied { perfmon } for pid=9018 comm="syz.3.9373" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 2819.909631][ T9026] R13: ffffc9000b777824 R14: fffff520016eef04 R15: 0000000000000001 [ 2819.926001][ T30] audit: type=1400 audit(1755016039.211:45299): avc: denied { create } for pid=9018 comm="syz.3.9373" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2819.953142][ C0] vkms_vblank_simulate: vblank timer overrun [ 2819.954990][ T9026] FS: 00007ffa9ce746c0(0000) GS:ffff8881247bc000(0000) knlGS:0000000000000000 [ 2819.973472][ T30] audit: type=1400 audit(1755016039.211:45300): avc: denied { write } for pid=9018 comm="syz.3.9373" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 2819.974616][ T9026] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2820.000510][ T9026] CR2: 00005555782975c8 CR3: 000000004a4b4000 CR4: 00000000003526f0 [ 2820.009792][ T9026] Kernel panic - not syncing: Fatal exception [ 2820.016046][ T9026] Kernel Offset: disabled [ 2820.020344][ T9026] Rebooting in 86400 seconds..