last executing test programs: 33.426349567s ago: executing program 3 (id=6043): r0 = accept$ax25(0xffffffffffffffff, &(0x7f0000000300)={{0x3, @null}, [@null, @default, @default, @bcast, @null, @rose, @netrom]}, &(0x7f0000000380)=0x48) dup(r0) prctl$PR_SET_TIMERSLACK(0x1d, 0x2) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x1000}, 0x4) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0x73220c8b}], 0x1}, 0x0) recvmmsg(r1, &(0x7f0000000400)=[{{0x0, 0x0, 0x0}, 0x7}, {{0x0, 0x0, 0x0}, 0x8}], 0x2, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) io_setup(0x6, &(0x7f00000003c0)=0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x60900, 0x0) io_submit(r3, 0x1, &(0x7f00000000c0)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x5, 0x0, r4, 0x0}]) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f00000010c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f00000000c0)={0xe, 0x18, 0xfa00, @id_tos={0x0, r6, 0x0, 0x3}}, 0x20) ioctl$SNDCTL_SEQ_PANIC(r4, 0x5111) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40000000000000061145c0000000000a61000006ca4ca209500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_CMAP(r7, 0x4bfb, &(0x7f0000000040)) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xfffe, @any, 0x3}, 0xe) r8 = accept4$unix(0xffffffffffffffff, &(0x7f0000000240)=@abs, &(0x7f00000002c0)=0x6e, 0x800) shutdown(r8, 0x0) r9 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r9, 0x5423, &(0x7f0000000040)=0x15) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x3, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x0, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x6, 0x1, 0x5, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x3, 0xe, 0x0, 0x80008061, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8f, 0x4006, 0x6, 0x0, 0x5, 0x4, 0x8, 0x400, 0x80, 0x0, 0x5, 0x6, 0x8, 0x3, 0xfffffffe, 0x40], [0x10000007, 0x9, 0x8000012f, 0x5, 0x5, 0x6, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0xfffffeff, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x9, 0xea4, 0x4000, 0x4, 0x7, 0x7fff, 0x9, 0x420, 0x401, 0x5, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0x0, 0x4e0, 0x2, 0x4, 0xa, 0x4, 0x9, 0x81, 0x9, 0x9, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x6, 0x3, 0x9, 0x6, 0x3, 0x3, 0x1f, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x0, 0x7fff, 0x0, 0x5, 0x2000b, 0x9, 0x9, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x10000, 0x3, 0x5, 0x3e5, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x4, 0x38, 0xc, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0xffe, 0xa2, 0x7, 0xa9, 0x5, 0x9, 0xac8, 0xc0, 0x2, 0x6, 0x7ff, 0x12b, 0x3, 0x1, 0x4, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x4, 0xb, 0x5, 0x938, 0x6, 0xf, 0x0, 0xb9, 0xce7, 0x9, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0xffff, 0x2000a620, 0x2, 0x5, 0x1, 0x2, 0x7, 0xe7, 0x6, 0x16, 0xfff, 0x80000003, 0x5, 0x4, 0xc8, 0x9, 0xffffeffc, 0x10000, 0x3, 0x7e, 0x100, 0x9602, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x9, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) listen(0xffffffffffffffff, 0x9) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000880)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x95, 0x8000, 0x6, 0x3ff, 0xca5d, 0x8, "3cc6aeb5b03f20bfc27add9e7da178d48c82a43e9f8a535d14401ee2bd4c68581028f69942bfe9968546a0363408da24aabb9314a6c6c9986e5b1c179a1b4fd6aed1ac6c48fa834bea609a8c07250205378500a60a8208bccdd91fdf731cb33d2bd493b5e314ff640f312f0920b058ca0b11831f1dca31f431dcca6c938b65e95d258083ab77dbf33768aada0e17850697d26546fe"}}, 0x1ad) r10 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0xa, 0x2, 0x0, 0x7fff7ffc}]}) close_range(r10, 0xffffffffffffffff, 0x0) 31.607874404s ago: executing program 2 (id=6050): socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x2c, 0x3, 0x0) socket$kcm(0x2c, 0x3, 0x0) r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00c00e}, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000580)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[], 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x18, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x8914, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000002000)=""/102400, 0x19000) sendmsg$NFT_BATCH(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x140}}, 0x0) 30.449547776s ago: executing program 2 (id=6053): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000340)={0x2, &(0x7f0000019740)=[{0x3, 0x6, 0x7, 0xfffffffe}, {0x9, 0x6, 0xc9, 0x8}]}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000019700)=r1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) socket(0x10, 0x3, 0x0) read$msr(r2, &(0x7f00000004c0)=""/102392, 0x18ff8) syz_open_procfs(0x0, 0x0) r3 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r3, 0xc1105517, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x0, 0x4, 0x0, 0x54, 0x0, 'syz0\x00', 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r3, 0xc1105518, &(0x7f0000000040)={{0x22, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, [0x7, 0xfffffffffffffffc, 0x0, 0x2, 0x0, 0x0, 0x4, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x100000000000, 0x0, 0x0, 0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5fa, 0x0, 0x0, 0x8000000000000, 0x0, 0x9, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x7, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x8, 0x40000, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x8, 0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x6, 0x4, 0x6, 0x2, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x8001]}) r4 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r4, &(0x7f0000000000), 0x10) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, &(0x7f0000000280)=0xc9, 0x4) readv(r4, &(0x7f0000019580)=[{&(0x7f00000194c0)=""/144, 0x90}], 0x1) sendmsg$can_bcm(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="05000000030800"/16, @ANYRES16, @ANYRES64=0x2710], 0x80}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x4, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000085000000500000009500000000000000"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@nfs_export_on}]}) chdir(&(0x7f00000000c0)='./bus\x00') r5 = creat(&(0x7f0000000440)='./file0\x00', 0x0) open_by_handle_at(r5, &(0x7f0000000140)=ANY=[@ANYBLOB="30000000f80000fb150705e8371f2efe0868327a31a705ec978547"], 0x30000) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0) 29.371663509s ago: executing program 3 (id=6054): syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) creat(&(0x7f0000000040)='./file1\x00', 0x0) r0 = inotify_init1(0x0) inotify_add_watch(r0, &(0x7f0000000440)='.\x00', 0x12000021) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'vxcan0\x00', 0x0}) connect$can_j1939(r1, &(0x7f00000001c0)={0x1d, r2, 0x2, {0x2, 0xff}, 0xff}, 0x18) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) kcmp(r3, r3, 0x4, 0xffffffffffffffff, 0xffffffffffffffff) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, 0x0, 0x0) r6 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r6, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r6, 0x7a0, &(0x7f0000000240)={@hyper}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r6, 0x7a8, &(0x7f0000000000)={{@my=0x1}, @my=0x1, 0x0, 0x0, 0x421}) 29.040171172s ago: executing program 2 (id=6057): r0 = getpgrp(0xffffffffffffffff) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x8082, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r2, 0x40405514, &(0x7f0000000a40)={0x1, 0x0, 0x0, 0x0, 'syz0\x00'}) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r2, 0x40405515, &(0x7f0000000540)={0x1, 0x6, 0x2, 0x5, 'syz0\x00', 0x7}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0a0000000900000042000e064000000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080), &(0x7f0000000140), 0x1003, r3}, 0x38) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000980)={0x0, &(0x7f0000000740)=""/194, &(0x7f0000000840), &(0x7f00000003c0), 0x3, r3}, 0x38) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{0x1}, 0x0, 0x0}, 0x20) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xe, 0x4, 0x4, 0x2, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000140)={r4, &(0x7f0000000080), 0x0}, 0x20) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'gretap0\x00', 0x1000}) socketpair(0x15, 0x1ed8cc1a34000a16, 0xfffffffe, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={0xffffffffffffffff, 0xe0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2, &(0x7f0000000140)=[0x0, 0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0], 0x0, 0x1a, &(0x7f00000001c0)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000200), &(0x7f0000000240), 0x8, 0x57, 0x8, 0x8, &(0x7f0000000280)}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000400)=r5, 0x4) r6 = socket$inet(0x2, 0xb4101b595713d732, 0x9) ioctl$sock_SIOCGIFBR(r6, 0x8940, &(0x7f0000000440)=@get={0x1, &(0x7f0000001600)=""/4096, 0xfff}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0x6, [@func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{0x4, 0x2}]}, @enum]}, {0x0, [0x0, 0x0, 0x0, 0x5f]}}, &(0x7f0000000600)=""/4088, 0x3e, 0xff8, 0x1, 0x0, 0x0, @void, @value}, 0x28) syz_usb_connect(0x5, 0x36, &(0x7f0000000680)=ANY=[@ANYBLOB="12010000c8d6a340ac050a038c65000000010902240001000000000904000002039d0200097872571d2f8cefb7090503"], 0x0) r7 = socket$rds(0x15, 0x5, 0x0) bind$rds(r7, &(0x7f0000000380)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendmsg$rds(r7, &(0x7f00000002c0)={&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0, 0x0, &(0x7f0000000040)=[@rdma_dest={0x18, 0x114, 0x2, {0x0, 0x54}}], 0x18, 0x8800}, 0x4000000) prlimit64(r0, 0x3, &(0x7f0000000080)={0xfffffffffffffffd, 0x3}, 0x0) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x7) rmdir(&(0x7f0000000040)='./control\x00') 28.511105556s ago: executing program 3 (id=6058): setresgid(0xee00, 0xee01, 0x0) setregid(0x0, 0x0) 27.496952239s ago: executing program 3 (id=6062): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000000300)=""/102376, 0x18fe8) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000500)=@raw={'raw\x00', 0x21, 0x3, 0x580, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x4b0, 0xffffffff, 0xffffffff, 0x4b0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private2, @private2, [], [], 'veth0\x00', 'syzkaller1\x00'}, 0x0, 0x220, 0x248, 0x0, {}, [@common=@inet=@hashlimit2={{0x150}, {'sit0\x00', {0x0, 0x9, 0x0, 0x0, 0x0, 0x8, 0x5}}}, @inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE1={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x4}}}, {{@ipv6={@empty, @mcast1, [], [], 'batadv0\x00', 'veth1\x00'}, 0x0, 0x200, 0x268, 0x0, {}, [@common=@inet=@policy={{0x158}, {[{@ipv6=@private1, [], @ipv4=@remote}, {@ipv6=@dev, [], @ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {@ipv4=@multicast2, [], @ipv6=@loopback}, {@ipv6=@rand_addr=' \x01\x00', [], @ipv4=@local}]}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5e0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r2, 0x6, 0x24, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1c}, 0xd}, 0x1c) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_SIOCBRDELBR(0xffffffffffffffff, 0x89a1, &(0x7f0000000100)='dvmrp0\x00') r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001640)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5c000000150001002abd7000fedbdf25e0000002000000000000000000000000fe8800000000000000000000000001014e2400004e2100020200100011000000", @ANYRES32=0x0, @ANYRES32=0xee01, @ANYBLOB="00000010020000000a"], 0x5c}, 0x1, 0x0, 0x0, 0x2843ca8725c9de81}, 0x4000) recvmmsg(r2, &(0x7f00000002c0), 0x220, 0x100, 0x0) r4 = io_uring_setup(0x71f7, &(0x7f00000002c0)={0x0, 0x0, 0x91, 0x0, 0x3cd}) setresuid(0xffffffffffffffff, 0xffffffffffffffff, 0xee01) syz_open_dev$radio(&(0x7f0000000080), 0xffffffffffffffff, 0x2) r5 = openat$dsp1(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r5, @ANYBLOB=',wfdno=', @ANYRESHEX]) io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x0, 0x0) setresuid(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) socket$can_raw(0x1d, 0x3, 0x1) 26.234729616s ago: executing program 3 (id=6065): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000440)={0x28, 0x0, 0x2710, @host}, 0x10) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x18, 0x3, &(0x7f0000000280)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffe}}, &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff}) vmsplice(r4, &(0x7f00000014c0)=[{&(0x7f0000000000)='|', 0xfd}], 0xf, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000006, 0x40032, 0xffffffffffffffff, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r2}, 0x10) r6 = syz_open_dev$sndctrl(&(0x7f0000000440), 0x1, 0x103000) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r6, 0xc4c85512, &(0x7f0000000480)={{0x3, 0x3, 0x24000000, 0x3ff, '\x00', 0x6}, 0x1, [0x9, 0x11, 0xfffffffffffffff9, 0x5, 0xf, 0x1, 0x0, 0xff, 0xffffffffffffffff, 0x9, 0x1, 0x8, 0xfffffffffffffff7, 0x4, 0x3ff, 0x1, 0x36, 0x482, 0xc0010, 0x9, 0x1, 0x3ff, 0x7ff, 0x5, 0x80, 0x0, 0x4, 0x6, 0xffffffff, 0x9, 0x1, 0x71, 0xa, 0x2, 0x1ff, 0x7fffffff, 0x9, 0x4, 0x5, 0x10, 0xfffffffffffffff7, 0x16, 0x9db6, 0x7f, 0xfffffffffffffff2, 0x2, 0x7, 0x7, 0x0, 0x8, 0x3, 0x303, 0xa2, 0x8000, 0x3, 0x400, 0x9, 0x1fd, 0x3, 0x2, 0xc9a8, 0xffffffff, 0x3, 0x8, 0xffff, 0x0, 0x10000, 0xffffffffffffffff, 0x5, 0x3, 0x5, 0x9, 0xec, 0x7f, 0xffffffffffffffff, 0x100000000, 0x9f1a, 0xffffffffffffffff, 0xffffffff, 0x1000008, 0x0, 0x9, 0x3, 0x9, 0x0, 0x4, 0x3, 0xa, 0x8, 0x8, 0x1, 0x2, 0x4, 0xbf, 0xe70, 0xfffffffffffffff7, 0xb, 0x8000000000000000, 0x6, 0x9, 0x5, 0x639, 0x8000000000000000, 0x4, 0x400, 0x9a06, 0x9, 0xffffffff00000000, 0x3, 0xb3, 0x200080000001, 0x5, 0xd30, 0x7, 0x4, 0x256, 0x6ff, 0x3, 0x7, 0x1ff, 0x6, 0x9, 0x0, 0x1b485fe1, 0x7, 0x7, 0xfffffffffffffff7, 0x9]}) setresgid(0xee00, 0xee01, 0x0) setregid(0xffffffffffffffff, 0x0) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) accept4(r0, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="240000001800010025bd700000000000020000200100fe030000000008000b0005000000964c70390d29ebd7ad25ca80822916ae3339dd44080099fd835f6ecdcdfdb9429a43d69ce2ab3d3d7becf041422999363f0cc881c98840ba48efe890ed434d6e89d4349d0b784cc3a0ff8e828878fc23ff821ae0def3"], 0x24}}, 0x0) 25.277541873s ago: executing program 3 (id=6067): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000ff000040720501cb6526010203010902120001000000000904"], 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r2 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000340)=@base={0x18, 0x2, 0x5, 0x1, 0xe3eddcc8c5fa8b03, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @value, @void, @void, @value}, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000400)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000003c0), 0x0, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x64) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r6}, 0x10) r7 = add_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000080)="f8", 0x1, 0xfffffffffffffffe) keyctl$KEYCTL_WATCH_KEY(0x20, r7, 0xffffffffffffffff, 0x0) pipe2$watch_queue(0x0, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r7, 0xffffffffffffffff, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, r7, 0xffffffffffffffff, 0xffffffffffffffff) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r2, &(0x7f0000000340), &(0x7f0000000040)=@tcp6}, 0x20) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000100), 0x4) close_range(r1, 0xffffffffffffffff, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x5c}}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0xe0a79000) syz_usb_control_io(r0, &(0x7f0000000040)={0x2c, 0x0, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, &(0x7f0000000300)={0x2c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000a80)={0x14, 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="0003a0000000a003"]}, 0x0) 25.247033873s ago: executing program 0 (id=6068): bind$inet(0xffffffffffffffff, 0x0, 0x0) keyctl$describe(0x6, 0x0, 0x0, 0x0) syz_usb_connect(0x3, 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x0, &(0x7f0000000180)={0x0, &(0x7f0000000240)}) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000080)=0xd10, 0x4) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e20, @local}, 0x10) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$inet_int(r1, 0x0, 0xb, 0x0, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x6770c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r5, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}}], 0x40000000000012d, 0x2, 0x0) setsockopt$inet_int(r5, 0x0, 0x7, &(0x7f0000000140)=0x30, 0x4) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2e, &(0x7f0000002840)={@broadcast, @link_local, @void, {@ipv4={0x800, @udp={{0x6, 0x4, 0x0, 0x3, 0x20, 0x68, 0x0, 0x0, 0x11, 0x0, @empty, @empty, {[@rr={0x7, 0x3, 0xc7}]}}, {0x0, 0x4e20, 0x8}}}}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r0, 0x9) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000074e4362cc90034000107000000000000000021db84a1e2253c50"], 0x14}, 0x1, 0x0, 0x0, 0x4000840}, 0x20040000) 24.56248779s ago: executing program 2 (id=6069): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000e6250000000000000001000000"], &(0x7f0000000080)='syzkaller\x00', 0x5, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000180)) ioctl$DRM_IOCTL_MODE_GETFB2(r0, 0xc06864ce, &(0x7f0000000340)={0x0, 0x0, 0x2, 0x0, 0x0, [], [0x0, 0x7], [0x0, 0x0, 0x2, 0x80000000], [0x0, 0x0, 0x1, 0x1]}) r1 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x11, 0xf, &(0x7f0000000600)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095002200000000"], &(0x7f00000000c0)='GPL\x00', 0xb, 0x0, 0x0, 0x100, 0xe0, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0)={0x1, 0xd, 0x6, 0x275}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8, @void, @value}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xd) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000007040)={{0x14}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OP={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x74}}, 0x0) memfd_secret(0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0x5}, 0x1c) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x89}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000002000)=""/102400, 0x19000) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) sendmmsg$inet6(r3, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) 24.561062091s ago: executing program 1 (id=6070): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000002c0)=ANY=[@ANYRES32, @ANYBLOB='6\x00'/12, @ANYRES32, @ANYBLOB="addaced30a01a7fe46005a6cdee853229216446b411c8d9e63e3d3cdab8325cdc8faa5cb28989108c94e95a12489c73629f24aaef11a6cafca29547a05f362658b4964f4c208f68ab3815a3a"], 0x20) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0xfff3}}, [@TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x80, 0x4b6, 0x401, 0x0, 0x12, 0xfffffff8}}, {0x4}}]}]}, 0x48}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000500)) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x9, 0x3, 0x10004, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) creat(&(0x7f0000000040)='./file0\x00', 0x22) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x10c4, 0xea90, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f00000000c0)={0x2c, &(0x7f0000000180)={0x0, 0x0, 0x7, {0x7, 0x0, "19daab4a73"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000500)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x1, 0x3, "c282fe"}, 0x0}) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000540)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000480)={0x20, 0x1, 0xe, "ea6aafaabfc5926708627c6c0963"}, 0x0}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_connect$uac1(0x2, 0xa2, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000a00)={0x84, &(0x7f0000000640)={0x0, 0xe, 0x6, "c846dbbf919c"}, &(0x7f0000000380)={0x0, 0xa, 0x1, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000880)={0x40, 0x17, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, &(0x7f00000008c0)={0x40, 0x19, 0x2, "815d"}, &(0x7f0000000900)={0x40, 0x1a, 0x2, 0x3}, 0x0, &(0x7f0000000980)={0x40, 0x1e, 0x1, 0x5}, 0x0}) 23.864244363s ago: executing program 2 (id=6073): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f00000000c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r0, &(0x7f0000006380)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000004200)={0x50, 0x0, r1, {0x7, 0x1f, 0x0, 0x2066012, 0x0, 0x0, 0x0, 0x80}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000090c400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000542d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ea8286a2fba523440000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000633956a1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007d6ab715107fa1820000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f6ffffffffffffff0000000000000e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e1ffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000286071480000000000b13bc1e6d970884f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f3ffffffffffffff00", 0x2000, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006340)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x40) getdents64(r2, 0x0, 0xfe0f) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000080)={0x29, 0x6, 0x0, {0x1, 0x200000000000, 0x0, 0x2, '', 0x8}}, 0x29) syz_fuse_handle_req(r0, &(0x7f00000021c0)="7b1713b4c6f02da7493fb6859f0143c68a58166f472c5078104b859bc37f9a49a8f85c9101df3b2736ff9bebcb1a3c2f570b28279b8ff7afdef7451b3d10b4578c2e81784b6e4f410800d997f0689546cee0852e9e9c64c1f95df7b136243cf7aee1b8e7a4e1d6e6fc01337370f0dfc098d975e9a6f90a08f5b845054d1e1fc81adadbf2836ff758bade0484377855b05b3556a91827599638458ad30baea03240b302638b88423ecaba6da1e40f6f1b24d60dde1652f2d5f818af43d49dd55c4eadea945e9b6aa744dca07ec2e00320bef5b045414836941469129670c4cdb953ed61efeeae2ced1b7cb3e7fa4c93cce5623a9e33c69d068b801fd1369aba759e2829c67c705853262fef6669aab956f0f733619dd361be5e1414c7e7ff6218e330156d609fa9f3244a0a4fb678a58e70b86f6dabc3331f755b786c42b4198149941a7a58c83f1f2811209025269c5ffcbe0c34ac98cc091cec2c993bca0aa8400ff9e39cc9fba8dda886f95357957bbad8bb850ab92f7aa9bebcdb0ef188749a1742e5597d199f3ccdc2d807bf757da45acc93e3e9645a1036cb041b3c38dafef367b8dae802bbbc03bacb905d40e1da78591687b416ee380103a670aa8f722c76e13f7f0e3effbb37f15a821b8315fe541e3ffc09289d96db1dfa8861e5da41c812b54ee20ca8b3180f2f46db56954791465cb572de0cce16d789d6fff216ca46977ed724dc0cc8cef7b295ebb2998a5c4662e32ae1001e59f3bfefcd72543bfe1aa6688d65c547089ec0fe1f1d9610095a5a4008b14f46775c368417376ee143856031947db71c455dc40eeeda210fbf258452781ce46e51f6df683a7918770f73d324d9401648d271cb9a7e919401567e400fec420cf363444a78eea03e73176abd6546e1657945aa88f64a21e07fc23edd74512cf89781e8ffe9bb1601ab25d31801332a6c5be9cebb6cb08207bb832106553ea9fc19b4b4f1f0cd55efc2925ffef75e9b12f06b5a7496506a274ca25f88398a1734b7013c3f78a2e49ef0d946a1aff362e37c9b5f5473de11401097722adda87944ee3eeb1bdde60e97484af4d2e5f8b0a9c63bb8bb99461b16edd824add1caf9d5247811cc4f6b48004774f1a4fe4dd125ddbfd8b69ff3ee314aeb445bee9f217a2f5a9e0e84ccd8718471f949086df6cdcbf95e568317e31dd01be1b826cf9a09373b16935fc864794a3886a2f4aacc42135db85f8921916a10aa7111a686979e2a5c9959cafc9774c416c4dfe0b9e06657feb2fbc31e7c11f6e2841680986557c1f2b1ec3c0fcc6a749a3c97a5b370550ab7110e25851b13c0b75a7fb0cd3c4659878209867659c216b467bdcf51e786a59fad084886490fc77e186ab827d844d0ac4682651fc4043f8e87b905532a53017ada44feee1f89f9bc6d2a8b144e721a479f7b90acb91033774f4c12df633548a9097c791ec7e80fa2607c86fce6e9abcae1296528b8488ccf18a4bb0fc9b50c15d294e8d380465465b4eeae26eb6800faba611785cd2ff95ca1923dfa47d5923f89e4eadb612002caceaebbe779c4e3a3833455752eae63689ab8dc03db63d82feeab7f1162eed5909b69ccd5abeb9c071da82cfc76cc692a51d99e0c4bdfa6c81c9878e893a77e1e7105e7910827ddb3353612fa8d5e547b43b5abfe50829c1eb7bfda1731db2a9a1e8f0fc298dfa7009679489f9d9323338b7e59f1e48419ca531d88170a5a1995f576aa125edae9e9ea26f6e9c4bc26323b7db0998c528a7b343ccd87ff44c77e6cfc0a324cc1d4ea79c30015f0caaeccd46e5db580aa5ce8030c2b13b37494557da58abbdc7ce9fc9afa49ce0e8a7a6fa058db210ed654203e7879cf5004ebec57522ed34481b749554b36cd7171209b0763e110096704604f2d3f28c5ddc66c877e3ab63f36137d5a67cbf872aa6af79cb3a66c9040009b5e1c7b718c1b8788156b82d6d800dbe9fc3d16c812a963c73599b79efb89aa74bdbd9b1a2dc0b8ad853f79c0867a3a45d7a1645059171877687a72dd5ed4213c0ab84ef6185e7935346a84450887bdb2b216883e907b13b03c133adc04ab3c5f60209bd90aad3d94443105f08f0ee1b2231e1a1f8cce71de74d5308b78b5d99ce4ad4573faba9fab48bc1615f14d453c67714b99f274de041512b07b885679e6f89f481c28b082084b853c9afcda31def2898284d6ca28fb124df67142821c9705e28093ded60992d9587fb466df839aa2a4973dd48f9372a55da6592646fc918e533955566a2d8dc59277308223aea4dbe0daf839f95516b8995e9eec87df1df9d38693e0824dca7423b08d553b0ae1c5c44533b918eaa02dd17b4c8ce515ae7de410970f670e17b5e3c0a207fb8464d5d442694a271d593fc23ac19619bac32ac17cc6705ce2e6262361eba24277a471602e7ca57cc614ee116e60a9e0b6ac5e3228ea2c650baf1a09e9e5c7a1b25a078d1d11a673d88f6ee33e50d036d7fe4b9c06adc70aede2e35c6738b255690ed3f7a8d2d14e36e360f3bb66978d6cfcfc41887c751c0efc9325d4485a2f561060413fe6af4ce40d87a476201f15a584fc7ba18ddfef5f1d729d5f544c2c6b06befccb444f0408451089f20b06f05ab7d6702b97819b0eff6fb090f21afb3076558e692920053702fc2348f8dade0cb2b007f38d6dcd4ed3bb42553b1bd684791743a1941e5bf2ed234f44be64a95b485a3e949538a40542f25ca4bfce44e291037ab282082f02157a96f4ca0a0c5cd39215fd07461093a4d87a7979f7aa97142bf5b9ef71db537f9acc90f22ca2ded5c1ecd1ba972d05db7f71e8466085c9b3e975fa3a948f2c4049d1a8e46f71157017a3a74ad25e215dcfe7a4c5cb0a7baea0b0ec60c5df82555c553ac60dd39174c721edc0304b836a4de539c3ee55401e13848018f889cc4a0fcd01d9f4978eb730fb1b4a94ede0283f8c95062f01c8c8a3169b2d5c50cdd4f3a248d80a26c950b4036fc6ffefaf5101269fe3594c2cc128220a1d0b5f9f23121f2b184894e129159eaa92d9a30e878839be44d20cbdff3c338cc95795c86121b2b498bd376e895c98d67f6a27eecb46a203aa9de744feedf27b6825cc17aaa098b5ca05cad6bdbe320908ed36bdc8a8f2c777eeb9b037b36c0e36019c264b3e36196501d6cc90e7b1899a72bea5c8a24a5ae62e3684a39a06208bd382cd32acfabd742c76334797fa0c09a2a2a7e1240974afe0f3d6eb44590cf171efb7602009a93bde85cea6701c765dbca7c6a879be41dd08847802d4f59e933df65f727cbb45e3a4a5019f503b6fad7e0338e653f8b2c87aa7f196444e0dc1be6d7c4f0c7ddd663d06ff1365a9c362384a33b0315adbfb2d73359c485cd5410d36d21044bd8d3771c5492803b19f7f3a1a5c3248e66786479fa4416a55855adebeb09528ff5add597790b97bddc16bb9b7b33a1f800701c4293e2c8428dc2684726cfe5539ae0a9bf89e1b6f1989fd0433cc865b308bd0c636402b4b285c290e2439b9ecf0eba156fb6b613ea7f97b04506fe28e9471343c854fdfd48945a7f564acc817e609be8f8a7fdee12e9b592fd8c5c08f51ba8cb95be12cfa497d1539a4b8217818d47ebb3cc669014261530205948fdb9983a0e5759afa9b290ce838102661750ab06d7fe65a39efa6af36c042d2dee36402a6686d58eb144b76033cab4482b8fbdd213a90170939ec98df1fdfca4b37b143a971b9b59fc351098942bba090056c20e8cfbfe8fcbe361d068c98a020f67e807b8db2e45cad83c9970907646c0049c05c1ed657d53d859f1a47bfe6f022be0689de224034d0160b1dbc878ba6dd685911288d7af22ff5eedc1634c36e25f51d0757c7b9c73d7937955da356dea68749d464a75f56c9f6ba36cc1ca8c2f3aa34beae14fba894ca705111cdb19094432c2f6caa0eac78ab09b0cee330f36b1b91a6a5d4896cd15d96c12547826559441cbf578f189f5f04526a4cf76d60144090c2386b747ad50f7962ef2950d2c6f4ff8477ad0681ab24c47ea7ded8c9accff0dfa30489f43f0f3182b88e757fd9a1d82e1c9bb4efe5215518a6e48c688b2dabbd15107c5c6245de0acfd740ea54e0ec212f405f25bc3aafc63009631a4e4749296d47c2bcf25cc95afceb0a1ddb3c6124208f5134981c30489b42eeb864b3123b03106c9b234a465d87c30ef36e00244390de36a5dd93794467ef37bd01b86387855d2ac24e05370212e845082bb22c8fcda0f0bc78ddf971b0b9d69fc50e0d907408e9c9ac4e5099f47db2d0c14d888e363ece768555362a08c408d0119c45f158aad695d455d28e223be2862c19262c9f43eff8855b5a9af4f2cede95e415e2f597bb64c8bb2d608f86b15950ffe2e6bea3cdb221cf8b7eb35e0bdf6638283b09c68cda0bf1ccb9e353a7f0afb58d806923e36b22db68615a7e4e04d0932d928afdc8af3963378ebd5e05058160ac67fadb7a7d9ec498e00f63671b84d880d196c93afb4fc823e7d6576ad824ffb4c90fc780b163a292899ccfcaed81dee2c992787a66800e206df3dfc4a6b441d54ccb1a19a587402a663d510e45a5b1aa96fc467efaf7e71cbbff087f3d2922a133466d5ae9f86b0bc39bb3093b87ac2db941b1fd9e40427402781425d6e8856a2c66cbdd274f4c689758db6dd58ec7d766b177739e8c9173f2b1946be5396aad6d7ed29d058ac231e8c2e6a9077b4a217df4580a2d72bcf0b73e4bd07465deb8798a55ee855b82f1fa7d3748a40485bd90fab94b617d92219c4b65efa022936895e51873058615a19b9d1347120c405c3254f290b4c8b99c8ea9dde3a749ec538421a29d27b48ccd83852abe1a461123e4d36e56508d1827880960362d10835df77f9d4be51f1447cac5ae2017a814de58cd99bcc0c194254b17114ea48f5a0cfe6547686088d527c65180474fd460ffea5d48767ceb65c6fa3d7d3c632591d2d9d65c6c3a35a6ae4dc56322cd84734b0e7a092a4c46c1c607afa6d0e477e8d04e4993e595ba708a0f4466cd8a89fbc06d3cd366007296a9f05b66cfdcd5b30b6745e71d513205d5dbe1e8516d9e9cf133caa994ec0ac2c543d107efd4b9a7d9ee1ee415830a6c2ea17114ea9683726f2c82741f9ad4ac1be6772f0809f18c13f4cfc82fd1b7b3bd29615336003c6784c03fbcae475a58a3c4d68099732c326dfb7643eb150f2354918077bb798b5ecf491cdd0765e3e1ed5d0a37840f1a28f7e188a021781f1896dae7153f9d6639bf66be0c7857d7eccd2a1e6c9fd0cc3594477bb005df9b29f680c966161e37bcec97fc2ef7a2c3bf64e4df5785c9b080c7f9c6d7c515408445d55da499c03ba66369a31157bb03588e84a5303c46cd393c5bd6fbbb8deed94b62d67a9351c259b263c6c4fa65a4dbdd7eee080d82cc5e478c885678edbc9cfce74169ab748d7f4a08aec3e114394fc1d5e361267b8f3fcf38a024928d58158560f7da427680e7611a9f1b8255c67e6ea6b597ebd31bed9fd6f85f9b6ee63d4374c1e50597d1c9f3c56b4266bc632ba66ebecc396f6bead40392dcc138098b4166ab7f8714bd4db0615480705dd200da92dc51ec215844d7599e0a6262e8d5dc6a9452db8994d8b8f19ad4029e0b41b5e13fd6b56230cecea57f3111fe6c78876b3e657fab112968e83a0b64ce9837b89f5dad0d5f0b8b410e3a9a56ab2e9143e90fe371a944989ee206eef777cf4a235333c647e45aab910af492bc7c2213246374251e23accf5818aa2f24823bcba12efe3658e1e2cb49a5d4ffd26453829739647eccd106605921641afe16bbe79c8739062eabeeda4d4a42cb70d84e1e1d3506c7bfba5f5135aaae85b03dc6518eb30d832175cedc5bdca95e600e04902d9eda90c1da4bdd3138ac889398c239068857103ad70b5d1d9fac27c8ccfbcfcf126d9a5441bc963bce4669047ac901a14ca7c7e76f94c77159cdbda5360e04bb539a9d5ccd16a8cc88bacaa5b952c86b163575d7f1cab58f0d612d796b570f3c5debd7d9abde7e24de2c252173f1edc93817192699bddad45eeb41ff398c1bee4d2194f38bf4d2b4ed3a8895476bc441f464753139e204ff5dee7f45ce639d7541c0d396141aeff30cbbfa7157a61993eec98a4356df98665546a1d1e8429fb0c78684000862aac50f7d9a1413e89958f4defd3f087769cafc32bcd6016e496b41b7754cfbe42b352346fd585fb19a80f4af9a19811311b5fc6ea8eb5519a3cf7dbc1a06eed41668e332224c1daa01776e0886044f5a95e5dffc8d9ccce7840eeae97e8cc916db95bdc33fb420e28030c6edb011d5281db1dbeac9bfcaf938a757e3939b025d339e69b9692c8c7352787d399f342e96096e37ca208609e5f93629e36ee442db9fb822ea236683f79875e7dc73ec97f98fe0795f9d83f473cc80a589043a7edd953473684ea4e80f698683a0fc1d8863adc44fc13c27a08921a681ca1ad76207b1a97f8fff7db247ea09b3a6407ea83d82d82d171fc80a8f5fb9f19cd7e94fe121a6a0ef9c4cff7a8689c0abf750dadcc7442c2ca5ed437af5e88e89b0a783a1164cd1eb2a33a64c919d9f08fe5aa7a775352ab6027a7b73d6fef51acebec5516c2a5f2b932b2621bbd2cdb415fce9ba1dbc3de205869fa0423adcedd5570ab0b4b64afafaa458b3840b48f018297aa46426d7893418033f00b5378eac6a70275ec860609b07851b88ecb5da05086adfb80f47c71a77301ca0f1520dfb7a800bc8421abf5eb94942ec818e3a1d45f09ff93e6549b3ef6152c6abe38231b4a82e355e27e363184df51418286d7073cf464eee02310e84b3eccabd2120fcca333130357e1967f67a69f437dcf6a20ca21797230aad086bd4c28348f58b80ec5d27626004533993b9f85897d00bc271a62ab67f92e2eed6d900000000549e8344ad90b47fb5c1ed5908bce94d03bbe98a87a1733b5031f89644c2d35d729e1375969a82f0252859219407c5c87f5d249d5eb8c17001fc7c6dc5d1825851b41e5e937f2c39d7f7196f38f83619da2cddce747bb0e906d0fc13a11fc6c2be3d140ea6da886cd5e194ca9dbff565d2a82e7e82dc5a36084bf02029ea05a9cfe1f3dc80489b426a14372232940ffad8124bd515f0a73fa85c2aa0cd51d76a0cc6e75ccc35b702a4fed4d2e2828d98939406ddc6df1048f0a22611859d6bfcbb0873d102e4b8a86b5d9af8056447f6c1552a603d9f67009fa070db73a01e1b4adbe4e841d0b9a92d148b626c386b25687817e5ec07dbbfa1d62d078578fe21d546414e3c5e29e8e086d7e542a2eb74a67127e7f171e076bbdd62767aae3db467db1df13b3121023bcee33f814d767a9ef14651f76ec89910ed33e9804df8619f69ad06bf0559b00d4efbf6f44e922d50a18ffa25d8ac58dec53a93642186c0ca81b07fe5c14c9c13397649a53ebfcec118e5bb84db053e6e505d07a09bb50f33906e7febac3c85ca337111dbfcb7b9becccaaefa3d857d48f0b3d8646d70fdcf2f1dfb89cc3ba1394cb5de24d999c88235418bc0f20d4036bd0113d298b91c44fe042d3b8e4070e3f828499972524601c4725389122c7fc3e38eb799f7b755f23bd5362880b9275e58eab2c8f42e583890cb84e17f35025d1d76dd28171bee561d21451b4b2ebf23b923221c9ea06b924815889d2b605af66539c3b0ffc30c7170a5581727f0faddb257cb6ab28b3456737d3588fa3bce0ba6a2a5c3c94301fa8a4e6db358731bd3a4a62b42181e04241010d7bc3e973b9fe428175ec8f8e6cbd4e53c8bd957621acb1e42504e6f8a7bb30c382058fc9dcd0cd0ba0b789c316cd58d7b5606cc2a66c872f10e6663346d572ecc37ad1c3d8146a137e35e54096ddc2a5e2d26765d75615fecd09b864b29adfe92763ab54272365f56feeb9b57059744e765485ee322cb879fd3c8fd8bc4727d860995c548bcd41852349f1b2227f5a1f39b24549693fb05c04ba8f190673d11eb27d0bf628489f9b8049f5f3a1e1fed97ba9881da0031ef5960b6b0af825cfae8252b931f6151cba9bf889a5c74051a176c56d3cbb8915d3f28f8f684629bd1e3f87f27909b4e8eca6b88cdd60f3b5bbe0641a469e396080fdd2feeac7a11703b758f1815f100ab2ca4403af34a655f4c35e62778c276c96bb94a3d9f58f3bbd7ae6c4f133f7c4199f18d02d66598a54769415b376bb04b520881f23b22b32685ea1ea0dc179ab2f33f07c7039d1a5eedd1905d2a8c7d3c9686758ba5aafdd74f36da7f5522aff5c40e565b50cdd92ce353c3d6c97ce87f0495bdb95d70ea52c8c26b87cd337fd2283b88d7301c32f26833451b8f7c2ee5f44eec58d9eef2a39b3021a29c8747d36a2dbca6c0c085399bb720000000000000009d67e17060abad89c7d8b8970244c2f11ad2f4ae878a3676659b77178a9b651b12cf9c21e658a32999d596af4648f636df4de8c037d1fa63b1a685e8850156bf99e00666dbc03d3e3b44018659743127f91d44c99b578b86a44f3bcf1523c8cb45accc3c5fedfd7796411eddfc3a7a6b7c57ae10fd4bd3fe9f662dc59747ac4b7cc2584ae3ce2e42a41066dd0d560f1b4c83edc57121dade5e397380bec5f40b5d0beb14aef21b2c68ccfd0eb4959b5e7f5b5779903963298e3c9a2141f145137de1d604d9124c3c4f60a4d54da38a7c32ef2632fe66a8ce8e95ee95a570e18e9fbd44884afe291550839dd61e65c952a3f5c6b61850d1c2a77e18fde734a305b407cf6dbf17afd66da6e42f0e8f66092df46c79b44711f6e8aafa831fa1188beea696672b0e94cc3cae584b30dccf053634f792c2d9f4c87e306991b407949f2870b525d123f9ca23142a0ee13d05f51ed4ff2653727ad5bf16453276b2d5e7d7a8a0a1c4847cb61ac4b08d9abee25165a120d156775a534a62f9af3a3b62726101b94ae1e14352262f017c5361b3341952d194a6a2d470e60df3fde61d343e0af8fdff36ad976af6732b732ceb69344550555174fa280153e08f74d81f4ee69c1eb44a3468e8cf78bf7c1663dae3d31553466faa207b8e9887cb54209fac0b6f6d12d9588351c76e6bad884799afe856a25b5fe737d0ba737a0f1a12b4eb3ede48a0c38e6787ab42fca1c7f2ab42fa6104d5a99aa36b73ac3622ccae122524c28a6557cb7d0a7c7eb5de795647dca0621fc2c9599441dae7cc2a8631252abb5e0f22e9355e0a156a1ab7b1641e345045e8303b5f6dda5c3c1cc2637700cea25c004460d101fc42ad78ae477739a4efbacc57272cfafae15292dc3b2800d9f42002c2062af9a1f329e11140f8317242c04ac1f11cdb45f5f9ab18877daa214c151fb9ac54e3e010b5e7944d7217442d5c4fc29956c1333cb932424096f5b6afe1128db53f7171be4372be8bae538bcb3e4a2eb29608678735a667135e0f2660956e9e2a3ed862209efe65d9ab2fbbf88e5d3384fb3362af00e1ec6b4d3ca40df442b70951026438877189c4b0ae136a9a35c131fdf19115e8dc1ee2b938bfbfdb3808aebbe7dfbbd3510c7070388f5813e8bc63be744b99116c4b84ea37d57c5da7a80cc883aa915d84a249ebfa78ceb124c63b3a0720b19483189ee50824e8581556f0520e434803204cd0f3dd09fc97c979f9a7e3f8e5eca8fccde98fc4939551338235c0c6378faade0d18f7050f29189485e01ec120239373c5478cd19ab27570921415a6680924baf9c5829f3f2115460d1fceb8a026fa1a0a0047fe1cd6fcf1861dd3784e006abfddfe79461c5001e4e32d99c5bc203c21f8c711c5ecccf8941093d95a8db73722bb7511443fb2670244cc1249492e92fc4bf7e06ec6f08c5c6931929d58232b551957b771ea5e4a932b037904b81916e662e3fe95af894e80f699e5c00ab664f381bd9c0bd41322a8b3cf367577429fa52c0f1c44ffc626c215e7103cba05bff4931d9a202c1eb9068f44983d1e0c6d9fb5fed738561651e854a3c1b362ae354a0b4a270386ed2dbef093bd82f07f25edfae31901cb86fd214576b25f769bcb215214c63026b2581a8d17779aae03ba310f3243b3631f4b01c9e3eb342c3bdb44d8e47cdc1683e3b1cfffef72e385cc8831f99425fc406575170e1c106618d5429144a436b9e92d241d8118b5cbe0dca5e8ddd86e671e13080eddcf8dee9e317d192a3a5386378de9b1ecd8cf5439cfbe9f65965e5a5f6c145627ac23fe30c2e06e623b0eca15b225b32b65ce568b656cec0e0d6752fdebffd39c7538472ad7a195b56fcad3fab80016ff006df6b01d785191e4fca143b14ce68b32571476a779515ccb14d35cf9aabd4849c03c9bf12a42cfc2a7146ed6c25892a9d1c48f95314f641142d38cd882e54534d69b3fcc18044309e6debef6dc79d7737956418b955d33737115b44360e0bac14b71e2e64f0c8aea428dce5b65e210c108f832a6041c0aab116488e5863cd1039dc8af537908be3541352bdad303de43387503d19d7c0f0390bdc5b95f1dfb0701fd0e14a22c210837cc0a1cb059de474f4476bfe9bddfe3e7977fb299e82d9eefb18111f7c4a5fbd406fca720fec69340d978f4c9832204d67f6fa5793325e04d4af84acde0b56158e4c606394286a4b3cfc04a426a665529b753e1ce2d6c613159844bd069a67b5b96cb8ec993f05a8e252ed3d8ed63d524af0845f519f9d47b85a773f37031cb91055fb963db50e6a1e368f10a82fa40ac055e0201c6d29661eadb76f8154ef9c1cc210ccf1ccb063e8c00324ed6a14fdefa0167a9abb04debbbf5e7b8a57a7772373c765947f0f67b5130d77a6ca6ab166147d4eba97b4ddf1465d25b02f4430227b5713a29fd84664bfdfa5fc450e48f5263eaca67c16033b79bf1cb819511cf16bae6ffd5d05a7d9cc93067b6f2512fea2424a9c7d178f653ffa7ce1c00924707e3817c7cd461cb2a8cc5eadc40821258eaad7720ee3976c5a60025c317480016e5e5bd884f3646651f3bdc1185ec1a4112eb24ba5b3b6f94ac66322042d4bc48cb5befabfcf950cf8a0165fba3fa019324b53fb56bbfaec7f4ec733e84c22f841c1c9c1dc51dd3ac4887e155ac4095a6b8846c8f401f3c2d48d4de18906193a9f05ed59e3b0add8bc27c0bad8418ccbb842123ce1d39fdeeaa7984dfba9ef121ab4d4d35de076262636f3815708e4bcf31e634a290b13317425b1a4a2e4ebf8537092c7e524c126faa9622bf1337168e003857805dd420a51816fea3cd37c34e483f64a2da3ab67442314ffff40727835a1bc7b9971ccb5f83183cf1a135defd468907b988d97028f904c4d9c712f7d0ed6abe4d80712a7b7e06efcbe6a5b83e32beb1556326af7a97437c35c6a706c6cf4403b98f5134547ac167fd1abcb9245ec3450202ab80e553952412032a6c3cfa64441d4aecabd1e182c50bf67801fd3b44b40648ac9926bbbd7095425a429f2a9550c2fd1267cbf6156897b705255cadf1c7f233f4effd788b3f446dba19e68bbf8b42ff6caf984a4eb51328ab5e2bc28366e8b4df4df967a166470a00", 0x2000, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001040)=ANY=[@ANYBLOB="b00000000000000000000000000000000000000000200000000000000000000000000000000000000200000000000000000020000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000c0000000000000", @ANYRES32=0x0, @ANYRES32=r0, @ANYBLOB="0021000000000000467700000000000000000000000000000000000001"], 0x0, 0x0, 0x0}) 23.570122592s ago: executing program 2 (id=6075): r0 = socket$inet6(0xa, 0x1, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000600)={0xffffffffffffffff}, 0x111, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000040)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e22, 0x0, @local, 0x7}, r2}}, 0x30) r3 = syz_open_dev$vcsu(&(0x7f0000000400), 0x5, 0x2) connect$pppoe(r3, &(0x7f0000000440)={0x18, 0x0, {0x3, @broadcast, 'team_slave_1\x00'}}, 0x1e) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c66368c64ec6abfaa85ee12bc8c8d40070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2dbe2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25b7cec51b82b41dd020c7e112a0058c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab190c092d077ce70590fbbd4f8bf4d", 0x117) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) move_pages(0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000100)=[0x7], 0x0, 0x0) timer_create(0x7, &(0x7f0000000340)={0x0, 0xb, 0x1, @thr={&(0x7f0000000180)="b4bcbd60ce34ec724077228992a785d65fd8ef28605b4a0016a3feb10d2975d556769c1e98fcbfccf62b540c94b4d7c203ceffc61514f99464351931a390cadf744b4d1d5c07daa7732816b6ea5da818b9a4affb8399f1fa222da65e91120699b856fcb406d77ee3615710f97e299c193e31f665d8ee98514d8fd5b5a1a5596c3dce807501357114404f0d65d10bfe0ca9cb630099f5b86c41214559d064bf03759fb99b50187c4834f1fe2c528df6a74994152c78072fa5272841758378d738c36f01e55d1f90b0", &(0x7f0000000280)="1a23fedc5b8a09ae6914ada7db4ab6e0a0aa7820ac0f8a568103dd2e190e649daec264af631fee7fe1d30e90fb4537e748fe37cb11795176e90d322fca0bb90e2fb50363ce9c2ab683104e5c54b4b4857d76b9831c04827660a730dedfa73ac93a34e9f6dbae795ab9a0022f1f973d996668fe47ed05092442e3daa604b6b5141455d30f69c1af2ec4b2"}}, &(0x7f0000000380)=0x0) timer_gettime(r5, &(0x7f00000003c0)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)=0x0) prlimit64(r6, 0xf, &(0x7f0000000140)={0x1, 0x4}, 0x0) sendmsg$OSF_MSG_ADD(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="0815000000051104000000000000000001000005540201"], 0x1508}, 0x1, 0x0, 0x0, 0x24000080}, 0x0) 22.076028233s ago: executing program 0 (id=6078): r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000380)={0xa, 0x4e23, 0x8, @mcast2, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'ipvlan1\x00', 0x0}) r2 = socket$inet_smc(0x2b, 0x1, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000e8000000000040d900008500000023000000850000000f00000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='&\x00\x00\x00\a'], 0x50) write(r4, &(0x7f0000000000)='U', 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000), 0xd) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000500)={&(0x7f0000000140)='mm_page_alloc\x00', r3}, 0x10) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x4d0, 0x0, 0x25, 0x148, 0x340, 0x60, 0x438, 0x2a8, 0x2a8, 0x438, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x2f8, 0x340, 0x0, {0x200003ae, 0x7f00}, [@common=@inet=@hashlimit1={{0x58}, {'geneve0\x00', {0x44, 0x0, 0x9, 0x0, 0x0, 0xffffffff, 0x7}}}, @common=@unspec=@bpf1={{0x230, 'bpf\x00', 0x0}, @pinned={0x1, 0x0, 0x6, './file0\x00'}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x6, 'syz0\x00'}}}, {{@ip={@broadcast, @multicast1, 0x0, 0x0, 'veth1_to_bond\x00', 'veth0\x00', {0xff}}, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@unspec=@cgroup0={{0x28}, {0x4}}, @common=@unspec=@statistic={{0x38}}]}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x9, 0x8001}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x530) sendmmsg$inet6(r0, &(0x7f0000001640)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)=[@pktinfo={{0x24, 0x29, 0x32, {@local, r1}}}], 0x28}}], 0x1, 0x800) r5 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r5, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000540)=[{&(0x7f00000000c0)="08001efbb07d586e", 0x8}], 0x1}, 0x48d0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/diskstats\x00', 0x0, 0x0) 21.91056113s ago: executing program 0 (id=6080): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0x3c, 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x40, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0xa}}]}, 0x40}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x32) setresuid(0x0, r4, 0x0) setreuid(0x0, r4) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r6, &(0x7f0000000000), 0xfffffecc) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r7, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) splice(r5, 0x0, r7, 0x0, 0x7f, 0x0) r8 = getuid() setreuid(r4, r8) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x22d81, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r9, 0x4018aee3, &(0x7f0000000200)=""/1) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000040)=ANY=[@ANYBLOB="e60e6a10", @ANYRESHEX=r11, @ANYBLOB="010000000000000000001400000008000a00fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRES64=r10], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) 21.345222162s ago: executing program 4 (id=6081): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000e625000000"], &(0x7f0000000080)='syzkaller\x00', 0x5, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0), 0x0, 0x0}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000180)={0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_GETCRTC(r2, 0xc06864a1, 0x0) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000340)={0x0, 0x0, 0x2, 0x0, 0x0, [], [0x0, 0x7], [0x0, 0x0, 0x2, 0x80000000], [0x0, 0x0, 0x1, 0x1]}) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB], 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x11, 0xf, &(0x7f0000000600)=ANY=[@ANYBLOB="180000002f0fd00e000000000100000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b700000000000000950022000000000015ef0344183fb2d91c1ad3c51b9354c18ba1793e9a5e55f175a3f02593c2203414dfe3b8f2d07c7f69aa4cab9ec5ca1fff957fefda08143bec798744e2c5d3e432f43e7a6b85bbc098292efc93099dbde2200a462c05afda30f2d8e0e68fc336c8b0326fd4d4a27d65c4063a82a6f6a08c3cbd8ad8cf106a15dc88e152f55e91eb54f34dc22fbf35f197c72e25f1e05e0d8cf80786aa46d252d47152"], &(0x7f00000000c0)='GPL\x00', 0xb, 0x0, 0x0, 0x100, 0xe0, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0)={0x1, 0xd, 0x6, 0x275}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8, @void, @value}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xd) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000007040)={{0x14}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OP={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x74}}, 0x0) memfd_secret(0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) r5 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r5, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0x5}, 0x1c) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x89}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000002000)=""/102400, 0x19000) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) sendmmsg$inet6(r5, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000140)={0x3ff, 0x2, 0x806}) 21.28279023s ago: executing program 1 (id=6082): socket$nl_route(0x10, 0x3, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = syz_io_uring_setup(0x10d2, &(0x7f0000000480)={0x0, 0x7734, 0x80, 0x0, 0x34f}, &(0x7f00000000c0)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x0, &(0x7f0000000200)}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x50, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r0, 0x47bc, 0x0, 0x0, 0x0, 0x0) 20.500345107s ago: executing program 4 (id=6083): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x0, @local}, 0x2}}, 0x26) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x1c, r2, 0x1, 0x60bd27, 0x4, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}]}, 0x1c}}, 0x20) (fail_nth: 7) 20.354838285s ago: executing program 4 (id=6084): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) bind$inet(r0, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) sendmsg$inet(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x40) getsockopt(r0, 0x200000000114, 0x2715, 0x0, &(0x7f0000000000)) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000600)=ANY=[], 0x114}], 0x1}, 0x0) ioprio_set$pid(0x2, 0x0, 0x6000) openat$fuse(0xffffff9c, &(0x7f0000000340), 0x2, 0x0) sendmsg$netlink(r1, &(0x7f0000000780)={&(0x7f0000000480)=@proc={0x10, 0x0, 0x25dfdbfd, 0x2000000}, 0xc, &(0x7f0000000540)=[{&(0x7f00000004c0)=ANY=[@ANYBLOB="180000001300a12230012fde2a7100fcdbdf250800090005"], 0x18}], 0x1, &(0x7f0000000640)=[@cred={{0x18}}], 0x18, 0x4080}, 0x4008000) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1d, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x3b}) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r5, 0x90009427, 0x0) timerfd_gettime(0xffffffffffffffff, &(0x7f00000001c0)) socket$inet6(0xa, 0x80002, 0x88) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='net/udp6\x00') ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r6, 0xc4c85512, &(0x7f00000007c0)={{0x0, 0x5, 0x8, 0x8, '\x00', 0x7}, 0x1, [0x5, 0x5, 0x3, 0x4, 0x3, 0x2, 0xc1, 0x7, 0x3, 0x6, 0xfff, 0x0, 0x100000000, 0x4, 0x81, 0x9ad5, 0x6, 0x4, 0x7ff, 0x8000000000000000, 0x9, 0xfffffffffffffff8, 0x0, 0x2, 0x6, 0x2, 0xe, 0x9, 0x2, 0x0, 0xfffffffffffffff8, 0x643, 0x4, 0x0, 0xb29, 0x7, 0x9, 0x7fffffffffffffff, 0x9, 0x7fffffffffffffff, 0x2, 0x7, 0x519, 0x7, 0x4, 0xa0d, 0x1, 0x5, 0xdbd3, 0x9, 0x100000000, 0x7fffffffffffffff, 0xa5, 0x1ff, 0x2, 0x7, 0x2, 0xfffffffeffffffff, 0x32c7, 0xffffffffffff0000, 0x6, 0x800, 0x5, 0xffffffff, 0x5, 0x5, 0x1, 0x101, 0xfffffffffffffff8, 0x0, 0x0, 0x2, 0x0, 0x5, 0x28000, 0x346, 0x9, 0xffffffff00000000, 0x7, 0x23fa, 0x9, 0x3, 0xc, 0x8001, 0x9, 0x8000000000000000, 0xf, 0x3, 0x1, 0x100, 0x3, 0x6, 0x8, 0x59, 0x7, 0x2, 0x0, 0x0, 0x8, 0x2, 0x1ff, 0x7eae, 0x8, 0xdc, 0x8, 0x6f, 0xd12e, 0x2, 0x4, 0x8, 0x3, 0x7fff, 0xa4e, 0x2, 0xfff, 0x0, 0x0, 0x100000001, 0x7, 0x282, 0x8, 0x5, 0x5, 0x1f9d, 0xf00000000000000, 0x401, 0x4, 0x3]}) 20.19441806s ago: executing program 1 (id=6085): r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000080), 0x200000, 0x0) close$fd_v4l2_buffer(r0) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000001780), 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x4000000, 0x12, r0, 0x10000000) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x14, 0x26, 0xffff, 0x70bd2b}, 0x14}}, 0x0) 20.082584308s ago: executing program 0 (id=6086): socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x2c, 0x3, 0x0) socket$kcm(0x2c, 0x3, 0x0) r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00c00e}, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000580)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[], 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x18, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x8914, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000002000)=""/102400, 0x19000) sendmsg$NFT_BATCH(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[], 0x140}}, 0x0) 19.296211404s ago: executing program 1 (id=6087): r0 = syz_usb_connect$hid(0x5, 0x3f, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1e71, 0x2010, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x0, 0x10, 0x5, 0x3, 0x0, 0x6669cc1368519859, 0x0, {0x9, 0x21, 0x5, 0x36, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0xc, 0x0, 0x7}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x81, 0x8}}]}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r1) sendmsg$NL80211_CMD_DEL_STATION(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)={0x1c, r3, 0x1, 0x70bd2d, 0x6, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x0) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB="000457"], 0x0, 0x0, 0x0, 0x0}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='huge=always,size=8']) chdir(&(0x7f0000000140)='./file0\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = landlock_create_ruleset(&(0x7f0000000040)={0x1000, 0x3, 0x1}, 0x18, 0x0) landlock_restrict_self(r7, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) r8 = landlock_create_ruleset(&(0x7f00000002c0)={0x2001}, 0x18, 0x0) r9 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x200000, 0x0) landlock_restrict_self(r8, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', r9, &(0x7f0000000000)='./file0\x00', 0x1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) 19.250867337s ago: executing program 0 (id=6088): syz_usb_connect$cdc_ecm(0x1, 0x4d, &(0x7f0000000400)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x2, 0xc73ebdfa468265f4, 0x7, [{{0x9, 0x4, 0x0, 0x7, 0x2, 0x2, 0x6, 0x0, 0x6, {{0x5}, {0x5, 0x24, 0x0, 0x8001}, {0xd, 0x24, 0xf, 0x1, 0x9, 0x9, 0x5, 0x81}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x7ff, 0x6, 0x4, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x4, 0x3, 0xea}}}}}]}}]}}, &(0x7f0000000940)={0x0, 0x0, 0xf, &(0x7f0000000080)=ANY=[@ANYBLOB="050f0f00010a1003"], 0x1, [{0x0, 0x0}]}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x4, 0x4, 0x4, 0x2, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xfffffffc, 0x2, 0x0, 0x0, @void, @value, @void, @value}, 0x50) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x24}}, 0x0) pivot_root(&(0x7f0000000440)='./file0\x00', &(0x7f00000003c0)='./file0/../file0/../file0/../file0\x00') setsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000000300)=""/102376, 0x18fe8) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3000000020000103000000a39a63f1ddff5998e60e037e00fbdbdf250200000e00000000140000008000000000000000"], 0x30}}, 0x4040) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ptrace$setregs(0xd, r3, 0x0, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb") ptrace$getregset(0x4205, r3, 0x2, &(0x7f0000000080)={0x0}) ioctl$SIOCSIFHWADDR(r0, 0x89f1, &(0x7f0000000900)={'ip6tnl0\x00', @random="0600002000"}) listxattr(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) 18.770528914s ago: executing program 4 (id=6089): r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000380)={0xa, 0x4e23, 0x8, @mcast2, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'ipvlan1\x00', 0x0}) r2 = socket$inet_smc(0x2b, 0x1, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000e8000000000040d900008500000023000000850000000f00000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='&\x00\x00\x00\a'], 0x50) write(r4, &(0x7f0000000000)='U', 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000), 0xd) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000500)={&(0x7f0000000140)='mm_page_alloc\x00', r3}, 0x10) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x4d0, 0x0, 0x25, 0x148, 0x340, 0x60, 0x438, 0x2a8, 0x2a8, 0x438, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x2f8, 0x340, 0x0, {0x200003ae, 0x7f00}, [@common=@inet=@hashlimit1={{0x58}, {'geneve0\x00', {0x44, 0x0, 0x9, 0x0, 0x0, 0xffffffff, 0x7}}}, @common=@unspec=@bpf1={{0x230, 'bpf\x00', 0x0}, @pinned={0x1, 0x0, 0x6, './file0\x00'}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x6, 'syz0\x00'}}}, {{@ip={@broadcast, @multicast1, 0x0, 0x0, 'veth1_to_bond\x00', 'veth0\x00', {0xff}}, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@unspec=@cgroup0={{0x28}, {0x4}}, @common=@unspec=@statistic={{0x38}}]}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x9, 0x8001}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x530) sendmmsg$inet6(r0, &(0x7f0000001640)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)=[@pktinfo={{0x24, 0x29, 0x32, {@local, r1}}}], 0x28}}], 0x1, 0x800) r5 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r5, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000540)=[{&(0x7f00000000c0)="08001efbb07d586e", 0x8}], 0x1}, 0x48d0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/diskstats\x00', 0x0, 0x0) 18.736807237s ago: executing program 4 (id=6090): r0 = syz_usb_connect$hid(0x5, 0x3f, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1e71, 0x2010, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x0, 0x10, 0x5, 0x3, 0x0, 0x6669cc1368519859, 0x0, {0x9, 0x21, 0x5, 0x36, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0xc, 0x0, 0x7}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x81, 0x8}}]}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r1) sendmsg$NL80211_CMD_DEL_STATION(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)={0x1c, r3, 0x1, 0x70bd2d, 0x6, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x0) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB="000457"], 0x0, 0x0, 0x0, 0x0}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='huge=always,size=8']) chdir(&(0x7f0000000140)='./file0\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = landlock_create_ruleset(&(0x7f0000000040)={0x1000, 0x3, 0x1}, 0x18, 0x0) landlock_restrict_self(r7, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) r8 = landlock_create_ruleset(&(0x7f00000002c0)={0x2001}, 0x18, 0x0) r9 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x200000, 0x0) landlock_restrict_self(r8, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', r9, &(0x7f0000000000)='./file0\x00', 0x1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) 16.206427945s ago: executing program 1 (id=6091): syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) creat(&(0x7f0000000040)='./file1\x00', 0x0) r0 = inotify_init1(0x0) inotify_add_watch(r0, &(0x7f0000000440)='.\x00', 0x12000021) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100"/12], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'vxcan0\x00', 0x0}) connect$can_j1939(r1, &(0x7f00000001c0)={0x1d, r2, 0x2, {0x2, 0xff}, 0xff}, 0x18) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) kcmp(r3, r3, 0x4, 0xffffffffffffffff, 0xffffffffffffffff) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, 0x0, 0x0) r6 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r6, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r6, 0x7a0, &(0x7f0000000240)={@hyper}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r6, 0x7a8, &(0x7f0000000000)={{@my=0x1}, @my=0x1, 0x0, 0x0, 0x421}) 16.080443455s ago: executing program 0 (id=6092): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='new default user:syz 000000040'], 0x2a, 0x0) r2 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) keyctl$get_keyring_id(0x0, r2, 0xefca115) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6770c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000006900000000000001000000940000000fad413e850000000700000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r5}, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000003800)=@newtaction={0x88c, 0x30, 0x12f, 0x0, 0x4, {}, [{0x878, 0x1, [@m_police={0x874, 0x1, 0x0, 0x0, {{0xb}, {0x848, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, {0x7, 0x0, 0x0, 0x0, 0x0, 0x7}, {0x7, 0x2, 0x2, 0x0, 0x0, 0x7}}}], [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x80000000, 0x0, 0x5, 0x0, 0x0, 0x0, 0xf9d7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x6e, 0x1, 0x3, 0x4, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x3, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0xb, 0x0, 0x4, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffff35, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x40000000, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x400, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0xfffffff1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x5, 0x5, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x3, 0x0, 0x1]}, @TCA_POLICE_RATE={0x404, 0x2, [0xffffffff, 0x0, 0x5, 0x0, 0x2, 0xb, 0xfffffffb, 0x0, 0x7, 0x401, 0x1, 0xffff8000, 0x90, 0x9fd, 0x2, 0xb8, 0xca2, 0x6, 0x3c, 0x7, 0x1, 0xa89c, 0x400, 0xc, 0x492217a0, 0x7, 0x5, 0x3, 0x1ff, 0x200e5, 0x2f, 0xd, 0x3, 0xa, 0x4, 0x1, 0x9, 0x11, 0x6154, 0x6, 0x3ff, 0x7, 0xd, 0x3, 0xc0000, 0x8, 0x8, 0xffffff40, 0x100, 0x3, 0x5, 0x7, 0xe0b2, 0xfffffffe, 0x8fc, 0x84, 0x9, 0x4, 0x9, 0x80000001, 0x6, 0x0, 0x8, 0x800, 0x9, 0x1, 0x100, 0x405, 0x8, 0x3, 0xb5, 0x10001, 0x4, 0x4, 0x7f, 0x0, 0x8, 0x2, 0x7f, 0x80000001, 0x2, 0x4, 0x0, 0x4, 0x8000, 0x0, 0x9, 0x80, 0x7, 0x5, 0x1, 0x0, 0x7, 0xeb22, 0xd, 0x8000, 0x1, 0x0, 0x4, 0x3ff, 0x400000, 0x10, 0x5, 0x3, 0x10000, 0x5, 0x1000001, 0x0, 0x2, 0x7, 0x5, 0x6, 0x5, 0x4, 0x2, 0x81, 0x0, 0x10, 0x6, 0x7fff, 0x800, 0xfffffff4, 0x10000, 0xd, 0x8, 0xba, 0x204, 0x89, 0x2, 0x6, 0x100, 0xa60, 0xffffa3e0, 0x86b9, 0xff, 0x1, 0x2, 0xf, 0x24b9, 0x3a, 0xe01, 0x1, 0x6430, 0xd, 0x8, 0x0, 0x3, 0x7eb7, 0x3, 0x0, 0x200, 0xfffffeff, 0x9, 0xff, 0xa, 0x6, 0x7, 0x180, 0x1, 0x8001, 0x100, 0xb, 0x8, 0x101, 0x6, 0x2, 0xfffffc00, 0x81, 0x81, 0x200, 0x80000001, 0x1, 0x1, 0x9, 0x7, 0x4, 0xb, 0x80, 0x0, 0x0, 0x0, 0x5, 0x2, 0x65, 0x4, 0xfffffa0c, 0x3, 0x0, 0x4, 0x4, 0x35bc0, 0x9, 0xfffffffa, 0x7, 0x5, 0x3, 0x0, 0x9, 0x8, 0x2b, 0x2, 0x5, 0x10001, 0x2, 0xf, 0x0, 0x1, 0x723, 0x0, 0xe, 0x9, 0x4, 0x6, 0x7, 0x200, 0xfffffbff, 0x7, 0x3, 0x8, 0x5, 0xfffffffb, 0x3, 0x7f, 0x2, 0x80000001, 0x0, 0x9, 0xf, 0xfffffffe, 0x928, 0x4, 0xfffffffd, 0x5, 0x6042, 0xb87, 0x6, 0x8d8d, 0x55, 0x101, 0x8, 0x64e8, 0x8, 0x82f, 0x772, 0x80a, 0xfff, 0x6, 0x3f7, 0x4, 0x8, 0x8, 0x1, 0x5d, 0x9, 0xd, 0x80]}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa}}}]}]}, 0x88c}}, 0x0) setitimer(0x0, &(0x7f0000000580)={{0x0, 0xea60}, {0x77359400}}, 0x0) r7 = signalfd(0xffffffffffffffff, &(0x7f00000001c0), 0x8) mkdir(&(0x7f0000000140)='./control\x00', 0x5) close(r7) r8 = inotify_init1(0x800) fcntl$setstatus(r7, 0x4, 0x2c00) gettid() fcntl$setsig(r8, 0xa, 0xe) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) rt_sigtimedwait(&(0x7f0000000040)={[0xffffffffffff7ff8]}, 0x0, 0x0, 0x8) inotify_add_watch(r8, &(0x7f0000000180)='./control\x00', 0xa4000960) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="50000000020605000000000000000000000000000c00078008000640001000000500010006000000050005000200000005000400000000000900020073797a31000000000c000300686173683a6970"], 0x50}}, 0x0) 15.637446905s ago: executing program 1 (id=6093): bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x48054) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB], 0x34}}, 0x84) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_open_dev$vbi(&(0x7f0000000100), 0x1, 0x2) r1 = syz_open_dev$swradio(&(0x7f0000000040), 0x0, 0x2) ioctl$VIDIOC_G_EXT_CTRLS(r1, 0xc0205648, &(0x7f00000000c0)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x98f905, 0xffffbfff, '\x00', @string=&(0x7f0000000180)=0xa3}}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_int(r2, 0x0, 0x17, &(0x7f0000000000)=0x7, 0x4) setsockopt$inet_int(r2, 0x0, 0x17, 0x0, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r3, 0x400455c8, 0xb) ioctl$TIOCSTI(r3, 0x5412, &(0x7f00000001c0)=0x5) setsockopt$inet_buf(r2, 0x0, 0x29, &(0x7f00000001c0)="22ec6870b6169c53ec2cfbd1f03a08047c7f6034dac535277a10f4b764d2201a844097786b940eacda85b2ee64b68c19666252c9faea0c5e6c59885024c8947b28e06be46f3ffd91aeac89a1940cda845304f689a8e382093e6e815bacb037e9f1d73be2b54ba9bc3e7574f82edfdad2c47e2e239b44b82ece66180a898435b9bad9c8419a768d54b93a61ad6c8a35a3cf4de4aa0dbb7d1ac4566ee00dfd996e38b265d65b987955adda", 0xaa) 15.458446926s ago: executing program 4 (id=6094): r0 = syz_open_dev$vim2m(&(0x7f0000000780), 0x10001, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000480)={0x12, 0x1, 0x0, "8eb8a828e93b07f1dd06da7a41bfeac48048beb159fbba176fb1de26098c68d9"}) r1 = socket(0x10, 0x3, 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000200)='tmpfs\x00', 0x0, &(0x7f00000007c0)='usrquota') chdir(&(0x7f0000000100)='./file1\x00') r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x766c618eb221465a) r3 = socket$inet6(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000340)=@raw={'raw\x00', 0x3c1, 0x3, 0x1308, 0x1128, 0x268, 0x300, 0x1128, 0x268, 0x1238, 0x460, 0x460, 0x1238, 0x460, 0x9, 0x0, {[{{@uncond, 0x0, 0x1108, 0x1128, 0xd8000000, {0x9401}, [@common=@unspec=@cgroup1={{0x1030}, {0x2, 0x1, 0x20, 0x0, './cgroup/syz0\x00', 0xffffffff}}, @common=@ah={{0x30}, {[], 0x0, 0x0, 0x74}}]}, @unspec=@NOTRACK={0x20}}, {{@ipv6={@remote, @private1, [], [0xffffff00], 'ip6gretap0\x00', 'ip6_vti0\x00', {}, {}, 0x0, 0x0, 0x1}, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1368) quotactl_fd$Q_SETINFO(r2, 0xffffffff80000600, 0x0, &(0x7f0000000040)={0x1, 0xfffffffffffffffc, 0x0, 0x4}) quotactl$Q_SYNC(0xffffffff80000100, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'veth1_to_bridge\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000080)=@newqdisc={0x88, 0x24, 0xf0b, 0x8070bd2a, 0x0, {0x60, 0x0, 0x0, r5, {0x0, 0xc}, {0xffff, 0xffff}, {0x0, 0xa}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x8, [0x9, 0x4, 0x10, 0xa, 0xd, 0x0, 0xb, 0xb, 0x1, 0x1, 0x40, 0xf, 0x8, 0x1, 0xb, 0x10], 0x1, [0xfffe, 0x5, 0x6, 0x0, 0x1ff, 0xfffd, 0x400, 0x5, 0x0, 0xd, 0x3, 0x6, 0x2, 0x101, 0x2, 0xc14], [0x4, 0x6, 0x4, 0x0, 0x3, 0x8, 0x7fff, 0x2c0, 0x3c0, 0x4, 0x8, 0x200, 0x7, 0xffff, 0x9, 0x71e0]}}}}]}, 0x88}}, 0x0) arch_prctl$ARCH_SHSTK_UNLOCK(0x5004, 0x2) unlink(&(0x7f0000000280)='./bus\x00') quotactl$Q_SYNC(0xffffffff80000100, 0x0, 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/warn_count', 0x210741, 0x82) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x18, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000001000000850000000e000000850000002a00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r6 = openat$full(0xffffffffffffff9c, &(0x7f0000000380), 0x8903, 0x0) connect$unix(r6, &(0x7f00000003c0)=@file={0x1, './bus\x00'}, 0x6e) r7 = syz_io_uring_setup(0x5c2, &(0x7f00000002c0)={0x0, 0x983e, 0x800, 0x1003, 0x2db}, &(0x7f0000000240)=0x0, &(0x7f0000000540)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000340)=0xfffffff8, 0x0, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r9 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x2400, 0x2e) lseek(r9, 0x101, 0x1) getdents64(r9, 0x0, 0x6d0821ca1fc60d2f) io_uring_enter(r7, 0x7586, 0xcba2, 0x9, 0x0, 0x0) 8.555997495s ago: executing program 32 (id=6075): r0 = socket$inet6(0xa, 0x1, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000600)={0xffffffffffffffff}, 0x111, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000040)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e22, 0x0, @local, 0x7}, r2}}, 0x30) r3 = syz_open_dev$vcsu(&(0x7f0000000400), 0x5, 0x2) connect$pppoe(r3, &(0x7f0000000440)={0x18, 0x0, {0x3, @broadcast, 'team_slave_1\x00'}}, 0x1e) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c66368c64ec6abfaa85ee12bc8c8d40070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2dbe2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25b7cec51b82b41dd020c7e112a0058c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab190c092d077ce70590fbbd4f8bf4d", 0x117) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) move_pages(0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000100)=[0x7], 0x0, 0x0) timer_create(0x7, &(0x7f0000000340)={0x0, 0xb, 0x1, @thr={&(0x7f0000000180)="b4bcbd60ce34ec724077228992a785d65fd8ef28605b4a0016a3feb10d2975d556769c1e98fcbfccf62b540c94b4d7c203ceffc61514f99464351931a390cadf744b4d1d5c07daa7732816b6ea5da818b9a4affb8399f1fa222da65e91120699b856fcb406d77ee3615710f97e299c193e31f665d8ee98514d8fd5b5a1a5596c3dce807501357114404f0d65d10bfe0ca9cb630099f5b86c41214559d064bf03759fb99b50187c4834f1fe2c528df6a74994152c78072fa5272841758378d738c36f01e55d1f90b0", &(0x7f0000000280)="1a23fedc5b8a09ae6914ada7db4ab6e0a0aa7820ac0f8a568103dd2e190e649daec264af631fee7fe1d30e90fb4537e748fe37cb11795176e90d322fca0bb90e2fb50363ce9c2ab683104e5c54b4b4857d76b9831c04827660a730dedfa73ac93a34e9f6dbae795ab9a0022f1f973d996668fe47ed05092442e3daa604b6b5141455d30f69c1af2ec4b2"}}, &(0x7f0000000380)=0x0) timer_gettime(r5, &(0x7f00000003c0)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)=0x0) prlimit64(r6, 0xf, &(0x7f0000000140)={0x1, 0x4}, 0x0) sendmsg$OSF_MSG_ADD(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="0815000000051104000000000000000001000005540201"], 0x1508}, 0x1, 0x0, 0x0, 0x24000080}, 0x0) 1.044177398s ago: executing program 33 (id=6092): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='new default user:syz 000000040'], 0x2a, 0x0) r2 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) keyctl$get_keyring_id(0x0, r2, 0xefca115) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6770c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000006900000000000001000000940000000fad413e850000000700000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r5}, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000003800)=@newtaction={0x88c, 0x30, 0x12f, 0x0, 0x4, {}, [{0x878, 0x1, [@m_police={0x874, 0x1, 0x0, 0x0, {{0xb}, {0x848, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, {0x7, 0x0, 0x0, 0x0, 0x0, 0x7}, {0x7, 0x2, 0x2, 0x0, 0x0, 0x7}}}], [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x80000000, 0x0, 0x5, 0x0, 0x0, 0x0, 0xf9d7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x6e, 0x1, 0x3, 0x4, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x3, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0xb, 0x0, 0x4, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffff35, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x40000000, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x400, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0xfffffff1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x5, 0x5, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x3, 0x0, 0x1]}, @TCA_POLICE_RATE={0x404, 0x2, [0xffffffff, 0x0, 0x5, 0x0, 0x2, 0xb, 0xfffffffb, 0x0, 0x7, 0x401, 0x1, 0xffff8000, 0x90, 0x9fd, 0x2, 0xb8, 0xca2, 0x6, 0x3c, 0x7, 0x1, 0xa89c, 0x400, 0xc, 0x492217a0, 0x7, 0x5, 0x3, 0x1ff, 0x200e5, 0x2f, 0xd, 0x3, 0xa, 0x4, 0x1, 0x9, 0x11, 0x6154, 0x6, 0x3ff, 0x7, 0xd, 0x3, 0xc0000, 0x8, 0x8, 0xffffff40, 0x100, 0x3, 0x5, 0x7, 0xe0b2, 0xfffffffe, 0x8fc, 0x84, 0x9, 0x4, 0x9, 0x80000001, 0x6, 0x0, 0x8, 0x800, 0x9, 0x1, 0x100, 0x405, 0x8, 0x3, 0xb5, 0x10001, 0x4, 0x4, 0x7f, 0x0, 0x8, 0x2, 0x7f, 0x80000001, 0x2, 0x4, 0x0, 0x4, 0x8000, 0x0, 0x9, 0x80, 0x7, 0x5, 0x1, 0x0, 0x7, 0xeb22, 0xd, 0x8000, 0x1, 0x0, 0x4, 0x3ff, 0x400000, 0x10, 0x5, 0x3, 0x10000, 0x5, 0x1000001, 0x0, 0x2, 0x7, 0x5, 0x6, 0x5, 0x4, 0x2, 0x81, 0x0, 0x10, 0x6, 0x7fff, 0x800, 0xfffffff4, 0x10000, 0xd, 0x8, 0xba, 0x204, 0x89, 0x2, 0x6, 0x100, 0xa60, 0xffffa3e0, 0x86b9, 0xff, 0x1, 0x2, 0xf, 0x24b9, 0x3a, 0xe01, 0x1, 0x6430, 0xd, 0x8, 0x0, 0x3, 0x7eb7, 0x3, 0x0, 0x200, 0xfffffeff, 0x9, 0xff, 0xa, 0x6, 0x7, 0x180, 0x1, 0x8001, 0x100, 0xb, 0x8, 0x101, 0x6, 0x2, 0xfffffc00, 0x81, 0x81, 0x200, 0x80000001, 0x1, 0x1, 0x9, 0x7, 0x4, 0xb, 0x80, 0x0, 0x0, 0x0, 0x5, 0x2, 0x65, 0x4, 0xfffffa0c, 0x3, 0x0, 0x4, 0x4, 0x35bc0, 0x9, 0xfffffffa, 0x7, 0x5, 0x3, 0x0, 0x9, 0x8, 0x2b, 0x2, 0x5, 0x10001, 0x2, 0xf, 0x0, 0x1, 0x723, 0x0, 0xe, 0x9, 0x4, 0x6, 0x7, 0x200, 0xfffffbff, 0x7, 0x3, 0x8, 0x5, 0xfffffffb, 0x3, 0x7f, 0x2, 0x80000001, 0x0, 0x9, 0xf, 0xfffffffe, 0x928, 0x4, 0xfffffffd, 0x5, 0x6042, 0xb87, 0x6, 0x8d8d, 0x55, 0x101, 0x8, 0x64e8, 0x8, 0x82f, 0x772, 0x80a, 0xfff, 0x6, 0x3f7, 0x4, 0x8, 0x8, 0x1, 0x5d, 0x9, 0xd, 0x80]}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa}}}]}]}, 0x88c}}, 0x0) setitimer(0x0, &(0x7f0000000580)={{0x0, 0xea60}, {0x77359400}}, 0x0) r7 = signalfd(0xffffffffffffffff, &(0x7f00000001c0), 0x8) mkdir(&(0x7f0000000140)='./control\x00', 0x5) close(r7) r8 = inotify_init1(0x800) fcntl$setstatus(r7, 0x4, 0x2c00) gettid() fcntl$setsig(r8, 0xa, 0xe) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) rt_sigtimedwait(&(0x7f0000000040)={[0xffffffffffff7ff8]}, 0x0, 0x0, 0x8) inotify_add_watch(r8, &(0x7f0000000180)='./control\x00', 0xa4000960) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="50000000020605000000000000000000000000000c00078008000640001000000500010006000000050005000200000005000400000000000900020073797a31000000000c000300686173683a6970"], 0x50}}, 0x0) 44.85195ms ago: executing program 34 (id=6093): bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x48054) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB], 0x34}}, 0x84) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_open_dev$vbi(&(0x7f0000000100), 0x1, 0x2) r1 = syz_open_dev$swradio(&(0x7f0000000040), 0x0, 0x2) ioctl$VIDIOC_G_EXT_CTRLS(r1, 0xc0205648, &(0x7f00000000c0)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x98f905, 0xffffbfff, '\x00', @string=&(0x7f0000000180)=0xa3}}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_int(r2, 0x0, 0x17, &(0x7f0000000000)=0x7, 0x4) setsockopt$inet_int(r2, 0x0, 0x17, 0x0, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r3, 0x400455c8, 0xb) ioctl$TIOCSTI(r3, 0x5412, &(0x7f00000001c0)=0x5) setsockopt$inet_buf(r2, 0x0, 0x29, &(0x7f00000001c0)="22ec6870b6169c53ec2cfbd1f03a08047c7f6034dac535277a10f4b764d2201a844097786b940eacda85b2ee64b68c19666252c9faea0c5e6c59885024c8947b28e06be46f3ffd91aeac89a1940cda845304f689a8e382093e6e815bacb037e9f1d73be2b54ba9bc3e7574f82edfdad2c47e2e239b44b82ece66180a898435b9bad9c8419a768d54b93a61ad6c8a35a3cf4de4aa0dbb7d1ac4566ee00dfd996e38b265d65b987955adda", 0xaa) 0s ago: executing program 35 (id=6094): r0 = syz_open_dev$vim2m(&(0x7f0000000780), 0x10001, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000480)={0x12, 0x1, 0x0, "8eb8a828e93b07f1dd06da7a41bfeac48048beb159fbba176fb1de26098c68d9"}) r1 = socket(0x10, 0x3, 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000200)='tmpfs\x00', 0x0, &(0x7f00000007c0)='usrquota') chdir(&(0x7f0000000100)='./file1\x00') r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x766c618eb221465a) r3 = socket$inet6(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000340)=@raw={'raw\x00', 0x3c1, 0x3, 0x1308, 0x1128, 0x268, 0x300, 0x1128, 0x268, 0x1238, 0x460, 0x460, 0x1238, 0x460, 0x9, 0x0, {[{{@uncond, 0x0, 0x1108, 0x1128, 0xd8000000, {0x9401}, [@common=@unspec=@cgroup1={{0x1030}, {0x2, 0x1, 0x20, 0x0, './cgroup/syz0\x00', 0xffffffff}}, @common=@ah={{0x30}, {[], 0x0, 0x0, 0x74}}]}, @unspec=@NOTRACK={0x20}}, {{@ipv6={@remote, @private1, [], [0xffffff00], 'ip6gretap0\x00', 'ip6_vti0\x00', {}, {}, 0x0, 0x0, 0x1}, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1368) quotactl_fd$Q_SETINFO(r2, 0xffffffff80000600, 0x0, &(0x7f0000000040)={0x1, 0xfffffffffffffffc, 0x0, 0x4}) quotactl$Q_SYNC(0xffffffff80000100, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'veth1_to_bridge\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000080)=@newqdisc={0x88, 0x24, 0xf0b, 0x8070bd2a, 0x0, {0x60, 0x0, 0x0, r5, {0x0, 0xc}, {0xffff, 0xffff}, {0x0, 0xa}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x8, [0x9, 0x4, 0x10, 0xa, 0xd, 0x0, 0xb, 0xb, 0x1, 0x1, 0x40, 0xf, 0x8, 0x1, 0xb, 0x10], 0x1, [0xfffe, 0x5, 0x6, 0x0, 0x1ff, 0xfffd, 0x400, 0x5, 0x0, 0xd, 0x3, 0x6, 0x2, 0x101, 0x2, 0xc14], [0x4, 0x6, 0x4, 0x0, 0x3, 0x8, 0x7fff, 0x2c0, 0x3c0, 0x4, 0x8, 0x200, 0x7, 0xffff, 0x9, 0x71e0]}}}}]}, 0x88}}, 0x0) arch_prctl$ARCH_SHSTK_UNLOCK(0x5004, 0x2) unlink(&(0x7f0000000280)='./bus\x00') quotactl$Q_SYNC(0xffffffff80000100, 0x0, 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/warn_count', 0x210741, 0x82) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x18, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000001000000850000000e000000850000002a00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r6 = openat$full(0xffffffffffffff9c, &(0x7f0000000380), 0x8903, 0x0) connect$unix(r6, &(0x7f00000003c0)=@file={0x1, './bus\x00'}, 0x6e) r7 = syz_io_uring_setup(0x5c2, &(0x7f00000002c0)={0x0, 0x983e, 0x800, 0x1003, 0x2db}, &(0x7f0000000240)=0x0, &(0x7f0000000540)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000340)=0xfffffff8, 0x0, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r9 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x2400, 0x2e) lseek(r9, 0x101, 0x1) getdents64(r9, 0x0, 0x6d0821ca1fc60d2f) io_uring_enter(r7, 0x7586, 0xcba2, 0x9, 0x0, 0x0) kernel console output (not intermixed with test programs): ][ T30] audit: type=1400 audit(1745635967.412:2694): avc: denied { read } for pid=28403 comm="syz.0.5668" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 2132.053466][T10009] nzxt-smart2 0003:1E71:2010.0019: hidraw0: USB HID v0.05 Device [HID 1e71:2010] on usb-dummy_hcd.4-1/input0 [ 2132.115002][ T30] audit: type=1400 audit(1745635967.412:2695): avc: denied { open } for pid=28403 comm="syz.0.5668" path="/dev/autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 2132.201100][ T30] audit: type=1400 audit(1745635967.412:2696): avc: denied { ioctl } for pid=28403 comm="syz.0.5668" path="/dev/autofs" dev="devtmpfs" ino=98 ioctlcmd=0x937d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 2132.239896][T10009] usb 5-1: USB disconnect, device number 127 [ 2132.666861][T28413] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5669'. [ 2132.801004][ T30] audit: type=1400 audit(1745635968.362:2697): avc: denied { ioctl } for pid=28417 comm="syz.0.5672" path="cgroup:[4026532944]" dev="nsfs" ino=4026532944 ioctlcmd=0x940c scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 2132.828520][ C1] vkms_vblank_simulate: vblank timer overrun [ 2132.868680][ T30] audit: type=1400 audit(1745635968.372:2698): avc: denied { write } for pid=28417 comm="syz.0.5672" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 2132.901236][T10009] usb 3-1: new high-speed USB device number 121 using dummy_hcd [ 2132.917328][T28418] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 4080 [ 2133.083411][T10009] usb 3-1: Using ep0 maxpacket: 32 [ 2133.094920][T10009] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2133.110568][T10009] usb 3-1: New USB device found, idVendor=1781, idProduct=0938, bcdDevice=75.9e [ 2133.120361][T10009] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2133.131929][T10009] usb 3-1: Product: syz [ 2133.152201][T10009] usb 3-1: Manufacturer: syz [ 2133.165009][T10009] usb 3-1: SerialNumber: syz [ 2133.179206][T10009] usb 3-1: config 0 descriptor?? [ 2133.629558][ T5863] usb 1-1: new low-speed USB device number 124 using dummy_hcd [ 2133.899134][T28429] siw: device registration error -23 [ 2133.982061][ T30] audit: type=1400 audit(1745635969.542:2699): avc: denied { read } for pid=28414 comm="syz.2.5670" dev="sockfs" ino=101227 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 2134.020264][T28415] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2134.041468][T28434] xt_policy: neither incoming nor outgoing policy selected [ 2134.092350][T28415] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2134.143600][T28434] 9pnet_fd: Insufficient options for proto=fd [ 2134.146423][ T5863] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2134.976121][ T5863] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2135.014317][ T5863] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2135.060593][ T5863] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2135.108369][ T5863] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2135.148781][ T5863] usb 1-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 2135.180917][ T5863] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2135.204909][ T5863] usb 1-1: config 0 descriptor?? [ 2135.608924][ T5863] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 2135.636961][T10009] usb 1-1: USB disconnect, device number 124 [ 2135.953167][ T81] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 2135.973958][ T5863] usb 4-1: Using ep0 maxpacket: 16 [ 2135.981083][ T5863] usb 4-1: unable to get BOS descriptor or descriptor too short [ 2135.990813][ T5863] usb 4-1: config 8 has an invalid interface number: 162 but max is 0 [ 2136.000522][ T5863] usb 4-1: config 8 has no interface number 0 [ 2136.008079][ T5863] usb 4-1: config 8 interface 162 altsetting 8 endpoint 0xA has invalid maxpacket 1024, setting to 64 [ 2136.019810][ T5863] usb 4-1: config 8 interface 162 altsetting 8 endpoint 0x1 has an invalid bInterval 247, changing to 11 [ 2136.032490][ T5863] usb 4-1: config 8 interface 162 altsetting 8 has an invalid descriptor for endpoint zero, skipping [ 2136.045592][ T5863] usb 4-1: config 8 interface 162 altsetting 8 bulk endpoint 0xC has invalid maxpacket 16 [ 2136.047817][T10009] usb 3-1: USB disconnect, device number 121 [ 2136.056911][ T5863] usb 4-1: config 8 interface 162 altsetting 8 has a duplicate endpoint with address 0x4, skipping [ 2136.077710][ T5863] usb 4-1: config 8 interface 162 altsetting 8 has a duplicate endpoint with address 0xC, skipping [ 2136.089739][ T5863] usb 4-1: config 8 interface 162 altsetting 8 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 2136.106582][ T5863] usb 4-1: config 8 interface 162 has no altsetting 0 [ 2136.118272][ T5863] usb 4-1: New USB device found, idVendor=0482, idProduct=0107, bcdDevice= 1.00 [ 2136.128674][ T5863] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2136.137230][ T81] usb 5-1: Using ep0 maxpacket: 16 [ 2136.142720][ T5863] usb 4-1: Product: syz [ 2136.153251][ T5863] usb 4-1: Manufacturer: syz [ 2136.158279][ T5863] usb 4-1: SerialNumber: syz [ 2136.165005][ T81] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD7, changing to 0x87 [ 2136.182334][ T81] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 2136.195627][T28447] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 2136.209183][ T81] usb 5-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 2136.219475][ T81] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2136.230908][ T81] usb 5-1: Product: syz [ 2136.241559][ T81] usb 5-1: Manufacturer: syz [ 2136.246864][ T81] usb 5-1: SerialNumber: syz [ 2136.311238][T28461] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 2136.804803][ T81] usb 5-1: config 0 descriptor?? [ 2136.871707][ T5863] usb-storage 4-1:8.162: USB Mass Storage device detected [ 2136.885503][ T5863] usb-storage 4-1:8.162: Quirks match for vid 0482 pid 0107: 90 [ 2137.085331][ T81] appledisplay 5-1:0.0: Error while getting initial brightness: -110 [ 2137.555344][ T81] appledisplay 5-1:0.0: probe with driver appledisplay failed with error -110 [ 2137.587698][ T5863] usb 4-1: USB disconnect, device number 106 [ 2137.609273][T28451] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5683'. [ 2137.800324][T28471] SELinux: policydb string length 439091201 does not match expected length 8 [ 2137.823818][T28471] SELinux: failed to load policy [ 2138.108758][T10009] usb 5-1: USB disconnect, device number 2 [ 2138.714285][T10009] kernel write not supported for file /cpu/0/msr (pid: 10009 comm: kworker/0:0) [ 2139.333935][ T5863] usb 4-1: new high-speed USB device number 107 using dummy_hcd [ 2139.483071][T28506] input: syz1 as /devices/virtual/input/input100 [ 2139.693991][ T81] usb 1-1: new low-speed USB device number 125 using dummy_hcd [ 2139.811432][T28508] overlayfs: failed to clone upperpath [ 2139.883884][ T5863] usb 4-1: Using ep0 maxpacket: 32 [ 2140.000646][T28512] 9pnet_fd: Insufficient options for proto=fd [ 2140.364156][ T5863] usb 4-1: config index 0 descriptor too short (expected 35577, got 27) [ 2140.377456][ T5863] usb 4-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 2140.393087][ T5863] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 2140.402817][ T5863] usb 4-1: config 1 has no interface number 0 [ 2140.413482][ T5863] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2140.433587][ T5863] usb 4-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 2140.576235][ T5863] usb 4-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 2140.589958][ T5863] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2140.590123][ T81] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2140.616382][ T81] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2140.653137][ T5863] snd_usb_pod 4-1:1.1: Line 6 Pocket POD found [ 2140.943855][ T81] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2140.962527][ T81] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2141.003164][ T81] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2141.022267][ T81] usb 1-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 2141.034825][ T81] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2141.095205][ T81] usb 1-1: config 0 descriptor?? [ 2141.106828][T28520] FAULT_INJECTION: forcing a failure. [ 2141.106828][T28520] name failslab, interval 1, probability 0, space 0, times 0 [ 2141.119673][T28520] CPU: 0 UID: 0 PID: 28520 Comm: syz.2.5703 Not tainted 6.15.0-rc3-syzkaller-00094-g02ddfb981de8 #0 PREEMPT(full) [ 2141.119697][T28520] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 2141.119707][T28520] Call Trace: [ 2141.119713][T28520] [ 2141.119719][T28520] dump_stack_lvl+0x16c/0x1f0 [ 2141.119745][T28520] should_fail_ex+0x512/0x640 [ 2141.119763][T28520] ? __kmalloc_cache_noprof+0x57/0x3e0 [ 2141.119789][T28520] should_failslab+0xc2/0x120 [ 2141.119805][T28520] __kmalloc_cache_noprof+0x6a/0x3e0 [ 2141.119827][T28520] ? io_wq_create+0xcc/0xa30 [ 2141.119847][T28520] io_wq_create+0xcc/0xa30 [ 2141.119866][T28520] io_uring_alloc_task_context+0x211/0x690 [ 2141.119891][T28520] ? __pfx_io_uring_alloc_task_context+0x10/0x10 [ 2141.119914][T28520] ? __pfx_io_wq_submit_work+0x10/0x10 [ 2141.119929][T28520] ? __pfx_io_wq_free_work+0x10/0x10 [ 2141.119951][T28520] __io_uring_add_tctx_node+0x2dd/0x500 [ 2141.119974][T28520] ? __pfx___io_uring_add_tctx_node+0x10/0x10 [ 2141.119998][T28520] ? __fget_files+0x20e/0x3c0 [ 2141.120042][T28520] __io_uring_add_tctx_node_from_submit+0x89/0x130 [ 2141.120066][T28520] __do_sys_io_uring_enter+0x123a/0x1630 [ 2141.120089][T28520] ? __pfx___do_sys_io_uring_enter+0x10/0x10 [ 2141.120107][T28520] ? find_held_lock+0x2b/0x80 [ 2141.120125][T28520] ? __might_fault+0xe3/0x190 [ 2141.120140][T28520] ? __might_fault+0xe3/0x190 [ 2141.120154][T28520] ? __might_fault+0x13b/0x190 [ 2141.120173][T28520] ? rcu_is_watching+0x12/0xc0 [ 2141.120194][T28520] do_syscall_64+0xcd/0x260 [ 2141.120214][T28520] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2141.120230][T28520] RIP: 0033:0x7f8d62d8e969 [ 2141.120245][T28520] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2141.120260][T28520] RSP: 002b:00007f8d63b5c038 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 2141.120275][T28520] RAX: ffffffffffffffda RBX: 00007f8d62fb5fa0 RCX: 00007f8d62d8e969 [ 2141.120286][T28520] RDX: 0000000000000000 RSI: 00000000000047bc RDI: 0000000000000008 [ 2141.120296][T28520] RBP: 00007f8d63b5c090 R08: 0000000000000000 R09: 0000000000000000 [ 2141.120306][T28520] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2141.120315][T28520] R13: 0000000000000000 R14: 00007f8d62fb5fa0 R15: 00007ffee4012bb8 [ 2141.120336][T28520] [ 2141.505860][ T30] audit: type=1400 audit(1745635976.672:2700): avc: denied { create } for pid=28519 comm="syz.2.5703" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 2142.105374][T26477] usb 1-1: USB disconnect, device number 125 [ 2142.140998][T28522] FAULT_INJECTION: forcing a failure. [ 2142.140998][T28522] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2142.156635][T28522] CPU: 1 UID: 0 PID: 28522 Comm: syz.3.5693 Not tainted 6.15.0-rc3-syzkaller-00094-g02ddfb981de8 #0 PREEMPT(full) [ 2142.156662][T28522] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 2142.156673][T28522] Call Trace: [ 2142.156679][T28522] [ 2142.156685][T28522] dump_stack_lvl+0x16c/0x1f0 [ 2142.156710][T28522] should_fail_ex+0x512/0x640 [ 2142.156734][T28522] _copy_from_user+0x2e/0xd0 [ 2142.156756][T28522] restore_altstack+0x93/0x170 [ 2142.156783][T28522] ? __pfx_restore_altstack+0x10/0x10 [ 2142.156807][T28522] ? _raw_spin_unlock_irq+0x23/0x50 [ 2142.156822][T28522] ? lockdep_hardirqs_on+0x7c/0x110 [ 2142.156840][T28522] ? _raw_spin_unlock_irq+0x2e/0x50 [ 2142.156855][T28522] ? set_current_blocked+0xdd/0x120 [ 2142.156874][T28522] __do_sys_rt_sigreturn+0x13c/0x230 [ 2142.156898][T28522] ? __pfx___do_sys_rt_sigreturn+0x10/0x10 [ 2142.156924][T28522] ? rcu_is_watching+0x12/0xc0 [ 2142.156946][T28522] do_syscall_64+0xcd/0x260 [ 2142.156966][T28522] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2142.156983][T28522] RIP: 0033:0x7f821612ab39 [ 2142.156998][T28522] Code: 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 90 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 c7 c0 0f 00 00 00 0f 05 <0f> 1f 80 00 00 00 00 48 81 ec 48 01 00 00 49 89 d0 64 48 8b 04 25 [ 2142.157014][T28522] RSP: 002b:00007f8216f90340 EFLAGS: 00000293 ORIG_RAX: 000000000000000f [ 2142.157036][T28522] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007f821612ab39 [ 2142.157047][T28522] RDX: 00007f8216f90340 RSI: 00007f8216f90470 RDI: 0000000000000011 [ 2142.157057][T28522] RBP: 00007f8216f91090 R08: 0000000000000000 R09: 00007f8216f90df7 [ 2142.157067][T28522] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000002 [ 2142.157077][T28522] R13: 0000000000000001 R14: 00007f82163b6080 R15: 00007fffcea9cb78 [ 2142.157101][T28522] [ 2142.387612][ T5863] snd_usb_pod 4-1:1.1: set_interface failed [ 2142.394595][ T5863] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now disconnected [ 2142.404024][ T5863] snd_usb_pod 4-1:1.1: probe with driver snd_usb_pod failed with error -71 [ 2142.424290][ T5863] usb 4-1: USB disconnect, device number 107 [ 2142.434823][T28535] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5708'. [ 2142.449236][T28535] 9pnet_fd: Insufficient options for proto=fd [ 2142.823958][ T5929] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 2143.024160][ T5929] usb 5-1: Using ep0 maxpacket: 16 [ 2143.052189][ T5929] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD7, changing to 0x87 [ 2143.391107][ T5929] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 2143.415349][ T5929] usb 5-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 2143.475441][ T5929] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2143.505011][ T5929] usb 5-1: Product: syz [ 2143.516989][ T5929] usb 5-1: Manufacturer: syz [ 2143.522405][ T5929] usb 5-1: SerialNumber: syz [ 2143.551626][ T5929] usb 5-1: config 0 descriptor?? [ 2143.912811][T28532] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5707'. [ 2144.333034][ T5809] usb 1-1: new high-speed USB device number 126 using dummy_hcd [ 2144.357324][T28532] SELinux: policydb magic number 0x616e6572 does not match expected magic number 0xf97cff8c [ 2144.373176][T28570] netlink: 'syz.3.5721': attribute type 2 has an invalid length. [ 2144.384618][T28532] SELinux: failed to load policy [ 2144.389769][T28570] netlink: 119 bytes leftover after parsing attributes in process `syz.3.5721'. [ 2144.489256][ T5929] appledisplay 5-1:0.0: Error while getting initial brightness: -71 [ 2144.500035][ T5863] usb 3-1: new high-speed USB device number 122 using dummy_hcd [ 2144.504442][ T5809] usb 1-1: Using ep0 maxpacket: 16 [ 2144.516188][ T5929] appledisplay 5-1:0.0: probe with driver appledisplay failed with error -71 [ 2144.565173][ T5809] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2144.570979][ T5929] usb 5-1: USB disconnect, device number 3 [ 2144.787321][ T5863] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2144.833279][ T5809] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2144.835540][ T5863] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2144.899174][ T5809] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 2144.900055][ T5863] usb 3-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 2144.951965][ T5809] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 2144.954141][ T5863] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2145.106019][ T5863] usb 3-1: config 0 descriptor?? [ 2145.123159][ T5809] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2145.147277][ T5809] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 2145.168844][ T5809] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 2145.181234][ T5809] usb 1-1: Manufacturer: syz [ 2145.194088][ T5809] usb 1-1: config 0 descriptor?? [ 2145.531344][ T5863] cp2112 0003:10C4:EA90.001A: item fetching failed at offset 5/7 [ 2145.543463][ T5863] cp2112 0003:10C4:EA90.001A: parse failed [ 2146.510822][ T5863] cp2112 0003:10C4:EA90.001A: probe with driver cp2112 failed with error -22 [ 2147.360949][ T5929] usb 3-1: USB disconnect, device number 122 [ 2147.403310][ T5809] rc_core: IR keymap rc-hauppauge not found [ 2147.414870][ T5809] Registered IR keymap rc-empty [ 2147.420234][ T5809] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 2147.572768][ T5809] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 2148.002226][ T5809] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 2148.006140][T28606] siw: device registration error -23 [ 2148.082030][T28609] lo speed is unknown, defaulting to 1000 [ 2148.100392][T28609] lo speed is unknown, defaulting to 1000 [ 2148.416107][ T5809] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input101 [ 2148.436645][T28612] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 2148.445527][ T5898] IPVS: starting estimator thread 0... [ 2148.473981][ T5809] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 2148.531719][ T5809] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 2148.613152][ T5809] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 2148.654777][T28617] IPVS: using max 48 ests per chain, 115200 per kthread [ 2148.666065][ T5809] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 2148.719070][ T5809] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 2148.994851][ T5809] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 2149.074639][ T5809] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 2149.196139][ T5809] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 2149.303881][ T5809] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 2149.393357][ T5809] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 2149.447866][T28629] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5735'. [ 2149.566501][ T5898] kernel write not supported for file /cpu/0/msr (pid: 5898 comm: kworker/0:7) [ 2149.589689][ T5809] mceusb 1-1:0.0: Registered with mce emulator interface version 1 [ 2149.711276][ T5809] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 2149.928390][ T5809] usb 1-1: USB disconnect, device number 126 [ 2150.019305][T28634] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5736'. [ 2150.197131][T28642] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5737'. [ 2150.273805][T26477] kernel write not supported for file /cpu/0/msr (pid: 26477 comm: kworker/0:4) [ 2151.674514][ T5863] usb 4-1: new high-speed USB device number 108 using dummy_hcd [ 2152.110268][ T5863] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2152.123042][ T5863] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2152.149782][ T5863] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 2152.160568][ T5863] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2152.172797][ T5863] usb 4-1: config 0 descriptor?? [ 2152.564764][ T81] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 2153.055831][ T5863] cp2112 0003:10C4:EA90.001B: item fetching failed at offset 5/7 [ 2153.065695][ T5863] cp2112 0003:10C4:EA90.001B: parse failed [ 2153.077356][ T5863] cp2112 0003:10C4:EA90.001B: probe with driver cp2112 failed with error -22 [ 2153.082888][T28685] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5746'. [ 2153.148571][T28685] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5746'. [ 2153.347950][ T81] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 2153.366205][ T81] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 2153.588770][ T81] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 2153.657478][ T81] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 2153.669477][ T81] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 2153.685527][ T81] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 2153.704146][ T81] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 2153.732618][ T81] usb 5-1: Product: syz [ 2153.749493][ T81] usb 5-1: Manufacturer: syz [ 2153.769007][ T81] cdc_wdm 5-1:1.0: skipping garbage [ 2153.775604][ T81] cdc_wdm 5-1:1.0: skipping garbage [ 2153.781853][T28692] xt_policy: neither incoming nor outgoing policy selected [ 2153.801363][ T81] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 2153.815603][T28692] 9pnet_fd: Insufficient options for proto=fd [ 2153.843863][ T81] cdc_wdm 5-1:1.0: Unknown control protocol [ 2153.905319][T28696] 9pnet_fd: Insufficient options for proto=fd [ 2154.386478][T28676] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2154.395131][T28676] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2154.658594][ T5898] usb 5-1: USB disconnect, device number 4 [ 2155.889463][ T5898] usb 4-1: USB disconnect, device number 108 [ 2155.895660][ T5809] usb 1-1: new high-speed USB device number 127 using dummy_hcd [ 2156.593169][ T5809] usb 1-1: Using ep0 maxpacket: 8 [ 2156.614372][ T5809] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2156.692530][ T5809] usb 1-1: config 0 interface 0 altsetting 6 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 2156.704890][ T5809] usb 1-1: config 0 interface 0 altsetting 6 endpoint 0x5 has invalid wMaxPacketSize 0 [ 2156.719422][ T5809] usb 1-1: config 0 interface 0 altsetting 6 bulk endpoint 0x5 has invalid maxpacket 0 [ 2156.730024][ T5809] usb 1-1: config 0 interface 0 altsetting 6 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2156.743236][ T5809] usb 1-1: config 0 interface 0 has no altsetting 0 [ 2156.757636][ T5809] usb 1-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 2156.779217][ T5809] usb 1-1: New USB device strings: Mfr=0, Product=238, SerialNumber=0 [ 2156.813006][ T5809] usb 1-1: Product: syz [ 2156.889448][ T5809] usb 1-1: config 0 descriptor?? [ 2156.933173][ T5898] usb 4-1: new high-speed USB device number 109 using dummy_hcd [ 2157.041097][T28748] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 2157.546178][ T5898] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 2157.712564][ T5898] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2157.723688][ T5898] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2157.733671][ T5898] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 2157.756609][ T5898] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 2157.766729][ T5898] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 2157.775093][ T5898] usb 4-1: Manufacturer: syz [ 2157.782098][ T5898] usb 4-1: config 0 descriptor?? [ 2158.199610][ T5863] usb 1-1: USB disconnect, device number 127 [ 2158.200283][ T5898] appleir 0003:05AC:8243.001C: unknown main item tag 0x0 [ 2158.266705][ T5898] appleir 0003:05AC:8243.001C: No inputs registered, leaving [ 2158.317587][ T5898] appleir 0003:05AC:8243.001C: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.3-1/input0 [ 2158.559637][ T5898] usb 4-1: USB disconnect, device number 109 [ 2158.756814][T28758] FAULT_INJECTION: forcing a failure. [ 2158.756814][T28758] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2158.769934][T28758] CPU: 0 UID: 0 PID: 28758 Comm: syz.4.5772 Not tainted 6.15.0-rc3-syzkaller-00094-g02ddfb981de8 #0 PREEMPT(full) [ 2158.769958][T28758] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 2158.769969][T28758] Call Trace: [ 2158.769975][T28758] [ 2158.769982][T28758] dump_stack_lvl+0x16c/0x1f0 [ 2158.770006][T28758] should_fail_ex+0x512/0x640 [ 2158.770029][T28758] _copy_from_user+0x2e/0xd0 [ 2158.770052][T28758] copy_msghdr_from_user+0x98/0x160 [ 2158.770078][T28758] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 2158.770105][T28758] ? kfree+0x252/0x4d0 [ 2158.770126][T28758] ? __pfx__kstrtoull+0x10/0x10 [ 2158.770147][T28758] ___sys_sendmsg+0xfe/0x1d0 [ 2158.770178][T28758] ? __pfx____sys_sendmsg+0x10/0x10 [ 2158.770223][T28758] ? __pfx___might_resched+0x10/0x10 [ 2158.770250][T28758] __sys_sendmmsg+0x200/0x420 [ 2158.770276][T28758] ? __pfx___sys_sendmmsg+0x10/0x10 [ 2158.770318][T28758] ? __might_fault+0xe3/0x190 [ 2158.770334][T28758] ? __might_fault+0xe3/0x190 [ 2158.770347][T28758] ? __might_fault+0x13b/0x190 [ 2158.770369][T28758] __x64_sys_sendmmsg+0x9c/0x100 [ 2158.770393][T28758] do_syscall_64+0xcd/0x260 [ 2158.770413][T28758] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2158.770430][T28758] RIP: 0033:0x7f0bf678e969 [ 2158.770445][T28758] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2158.770461][T28758] RSP: 002b:00007f0bf7534038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 2158.770478][T28758] RAX: ffffffffffffffda RBX: 00007f0bf69b5fa0 RCX: 00007f0bf678e969 [ 2158.770489][T28758] RDX: 0000000000000002 RSI: 0000200000000b00 RDI: 0000000000000004 [ 2158.770499][T28758] RBP: 00007f0bf7534090 R08: 0000000000000000 R09: 0000000000000000 [ 2158.770508][T28758] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2158.770518][T28758] R13: 0000000000000000 R14: 00007f0bf69b5fa0 R15: 00007ffc48a51988 [ 2158.770540][T28758] [ 2158.962496][ C0] vkms_vblank_simulate: vblank timer overrun [ 2159.441742][ T5863] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 2159.481237][ T30] audit: type=1400 audit(1745635995.042:2701): avc: denied { create } for pid=28775 comm="syz.3.5776" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 2159.715229][ T30] audit: type=1400 audit(1745635995.042:2702): avc: denied { write } for pid=28775 comm="syz.3.5776" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 2159.756790][T28776] netlink: 'syz.3.5776': attribute type 1 has an invalid length. [ 2159.786611][T28780] lo speed is unknown, defaulting to 1000 [ 2159.866451][ T5863] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 2159.881005][ T5863] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2159.904294][ T5863] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2159.918129][T28776] 8021q: adding VLAN 0 to HW filter on device bond1 [ 2159.925344][ T5863] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 2159.942801][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 2159.942859][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 2159.951197][ T5863] usb 5-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 2159.966572][ T5863] usb 5-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 2159.979954][ T5863] usb 5-1: Manufacturer: syz [ 2160.003678][ T5863] usb 5-1: config 0 descriptor?? [ 2160.018432][T28781] bond1: (slave gretap1): making interface the new active one [ 2160.031510][T28781] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 2160.041367][T28780] lo speed is unknown, defaulting to 1000 [ 2160.165914][ T5898] usb 3-1: new high-speed USB device number 123 using dummy_hcd [ 2160.388280][ T5898] usb 3-1: Using ep0 maxpacket: 16 [ 2160.423872][ T5863] appleir 0003:05AC:8243.001D: unknown main item tag 0x0 [ 2160.431925][ T5863] appleir 0003:05AC:8243.001D: No inputs registered, leaving [ 2160.543334][ T5863] appleir 0003:05AC:8243.001D: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.4-1/input0 [ 2160.591287][ T5898] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD7, changing to 0x87 [ 2160.617759][T26477] usb 5-1: USB disconnect, device number 5 [ 2160.639229][ T5898] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 2160.675211][ T5898] usb 3-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 2160.690073][ T5898] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2160.699603][ T5898] usb 3-1: Product: syz [ 2160.709727][ T5898] usb 3-1: Manufacturer: syz [ 2160.729742][ T5898] usb 3-1: SerialNumber: syz [ 2160.741757][ T5898] usb 3-1: config 0 descriptor?? [ 2161.025746][T28796] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5778'. [ 2161.030988][ T5898] appledisplay 3-1:0.0: Error while getting initial brightness: -110 [ 2161.057345][ T5898] appledisplay 3-1:0.0: probe with driver appledisplay failed with error -110 [ 2161.158435][ T5863] usb 3-1: USB disconnect, device number 123 [ 2161.241099][T28799] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 2161.314986][T28804] JFS: discard option not supported on device [ 2161.357533][T28804] Mount JFS Failure: -22 [ 2161.362255][T28804] jfs_mount failed w/return code = -22 [ 2162.031131][T28817] netlink: 'syz.4.5784': attribute type 2 has an invalid length. [ 2162.040773][T28817] netlink: 19 bytes leftover after parsing attributes in process `syz.4.5784'. [ 2164.058924][T28833] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 2165.079459][T18219] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 2165.093196][T18219] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 2165.110258][T18219] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 2165.194286][T18219] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 2165.204122][T18219] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 2165.309827][T28844] lo speed is unknown, defaulting to 1000 [ 2165.317015][T28844] lo speed is unknown, defaulting to 1000 [ 2165.477826][T28848] netlink: 76 bytes leftover after parsing attributes in process `syz.0.5792'. [ 2166.754177][T28864] xt_policy: neither incoming nor outgoing policy selected [ 2166.812642][T28864] 9pnet_fd: Insufficient options for proto=fd [ 2167.291753][T25470] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2167.305809][T25470] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2167.373968][T27855] Bluetooth: hci4: command tx timeout [ 2167.442764][T25470] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2167.461063][T25470] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2167.543140][ T81] usb 3-1: new high-speed USB device number 124 using dummy_hcd [ 2167.568098][T28844] chnl_net:caif_netlink_parms(): no params data found [ 2167.682582][T25470] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2167.714150][ T81] usb 3-1: Using ep0 maxpacket: 16 [ 2167.720030][T25470] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2167.744791][ T81] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD7, changing to 0x87 [ 2167.813300][T28877] xt_policy: neither incoming nor outgoing policy selected [ 2167.835095][T28877] 9pnet_fd: Insufficient options for proto=fd [ 2168.014434][T26477] usb 4-1: new high-speed USB device number 110 using dummy_hcd [ 2168.153744][ T81] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 2168.205024][ T81] usb 3-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 2168.223838][ T81] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2168.273900][ T81] usb 3-1: Product: syz [ 2168.315300][T26477] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2168.326131][ T81] usb 3-1: Manufacturer: syz [ 2168.326767][T25470] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2168.331281][ T81] usb 3-1: SerialNumber: syz [ 2168.341995][T26477] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2168.342051][T26477] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 2168.342070][T26477] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2168.344039][T26477] usb 4-1: config 0 descriptor?? [ 2168.379881][T25470] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2168.414137][ T81] usb 3-1: config 0 descriptor?? [ 2168.704373][ T81] appledisplay 3-1:0.0: Error while getting initial brightness: -110 [ 2168.735436][ T81] appledisplay 3-1:0.0: probe with driver appledisplay failed with error -110 [ 2168.747352][T28881] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5797'. [ 2168.826556][T26477] cp2112 0003:10C4:EA90.001E: item fetching failed at offset 5/7 [ 2168.867920][T26477] cp2112 0003:10C4:EA90.001E: parse failed [ 2168.886200][T26477] cp2112 0003:10C4:EA90.001E: probe with driver cp2112 failed with error -22 [ 2168.938347][T28844] bridge0: port 1(bridge_slave_0) entered blocking state [ 2168.975196][T28844] bridge0: port 1(bridge_slave_0) entered disabled state [ 2169.030148][T28844] bridge_slave_0: entered allmulticast mode [ 2169.050361][T28844] bridge_slave_0: entered promiscuous mode [ 2169.140434][T28886] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5801'. [ 2169.381452][ T5898] kernel write not supported for file /cpu/0/msr (pid: 5898 comm: kworker/0:7) [ 2169.448362][T28844] bridge0: port 2(bridge_slave_1) entered blocking state [ 2169.465154][T27855] Bluetooth: hci4: command tx timeout [ 2169.528410][T28844] bridge0: port 2(bridge_slave_1) entered disabled state [ 2169.592977][ T81] usb 3-1: USB disconnect, device number 124 [ 2169.708472][T28844] bridge_slave_1: entered allmulticast mode [ 2169.726393][T28844] bridge_slave_1: entered promiscuous mode [ 2170.013076][T28844] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2170.029740][T28844] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2170.115671][T28844] team0: Port device team_slave_0 added [ 2170.395003][ T5898] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 2170.469150][T25470] bond1 (unregistering): (slave gretap1): Releasing backup interface [ 2170.555601][ T5898] usb 1-1: Using ep0 maxpacket: 16 [ 2170.570563][ T5898] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2170.582166][ T5898] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2170.595428][ T5898] usb 1-1: New USB device found, idVendor=0458, idProduct=5016, bcdDevice= 0.00 [ 2170.604808][ T5898] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2170.615347][ T5898] usb 1-1: config 0 descriptor?? [ 2170.810198][T28871] fuseblk: Unknown parameter 'deermþss†$ions' [ 2170.852530][T25470] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2170.867016][T25470] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2170.879995][T25470] bond0 (unregistering): Released all slaves [ 2171.015950][T25470] bond1 (unregistering): Released all slaves [ 2171.031523][T28844] team0: Port device team_slave_1 added [ 2171.041362][ T5898] kye 0003:0458:5016.001F: control desc unexpectedly large [ 2171.060075][ T5898] input: HID 0458:5016 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0458:5016.001F/input/input102 [ 2171.093748][T19698] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 2171.098349][ T5898] input: HID 0458:5016 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0458:5016.001F/input/input103 [ 2171.153485][T25470] tipc: Left network mode [ 2171.172143][ T5898] kye 0003:0458:5016.001F: input,hiddev0,hidraw0: USB HID v0.09 Device [HID 0458:5016] on usb-dummy_hcd.0-1/input0 [ 2171.188241][T28844] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2171.206065][T28844] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2171.235158][T28844] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2171.266497][T28844] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2171.274237][T28894] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2171.274467][T28894] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2171.302715][T28844] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2171.302966][T19698] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x72, changing to 0x2 [ 2171.380015][T25470] IPVS: stopping backup sync thread 19519 ... [ 2171.399214][T19698] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 24723, setting to 1024 [ 2171.417489][T19698] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 2171.432400][T19698] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 2171.445403][T28844] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2171.543634][T27855] Bluetooth: hci4: command tx timeout [ 2171.802622][T19698] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 2171.805815][ T5809] usb 1-1: USB disconnect, device number 2 [ 2171.812769][T19698] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2172.083674][T19698] usb 5-1: config 0 descriptor?? [ 2172.144455][T28904] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 2172.292419][ T5898] usb 4-1: USB disconnect, device number 110 [ 2172.436250][T19698] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 2172.437222][T28844] hsr_slave_0: entered promiscuous mode [ 2172.502053][T28844] hsr_slave_1: entered promiscuous mode [ 2172.523692][T28844] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 2172.531395][T28844] Cannot create hsr debugfs directory [ 2173.051832][T28925] SELinux: policydb magic number 0x6c65732f does not match expected magic number 0xf97cff8c [ 2173.063359][T28925] SELinux: failed to load policy [ 2173.108708][T19698] usb 5-1: USB disconnect, device number 6 [ 2173.383354][T25470] hsr_slave_0: left promiscuous mode [ 2173.409288][T25470] hsr_slave_1: left promiscuous mode [ 2173.416677][T25470] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2173.449398][T25470] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2173.582420][T25470] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2173.601750][T28937] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 2173.613118][T27855] Bluetooth: hci4: command tx timeout [ 2173.849587][T25470] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2174.032694][T25470] veth1_macvtap: left promiscuous mode [ 2174.057851][T25470] veth0_macvtap: left promiscuous mode [ 2174.069642][T28950] netlink: 76 bytes leftover after parsing attributes in process `syz.2.5814'. [ 2174.176295][T25470] veth1_vlan: left promiscuous mode [ 2174.197304][T25470] veth0_vlan: left promiscuous mode [ 2174.643254][ T5809] usb 4-1: new low-speed USB device number 111 using dummy_hcd [ 2174.818129][ T5809] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2174.866323][ T5809] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2174.906666][ T5809] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2174.921622][ T5809] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2174.939523][ T5809] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2174.969217][ T5809] usb 4-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 2174.992317][ T5809] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2175.033611][ T5809] usb 4-1: config 0 descriptor?? [ 2175.285532][ T5809] usb 4-1: USB disconnect, device number 111 [ 2176.137938][ T5809] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 2176.229497][T26477] usb 4-1: new full-speed USB device number 112 using dummy_hcd [ 2176.285063][ T30] audit: type=1400 audit(1745636011.842:2703): avc: denied { accept } for pid=28969 comm="syz.0.5820" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 2176.400971][T26477] usb 4-1: config index 0 descriptor too short (expected 69, got 36) [ 2176.411602][T26477] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2176.422400][T26477] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 2176.437534][T26477] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 2176.449109][T26477] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 2176.459592][T26477] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2176.509693][T26477] usb 4-1: New USB device found, idVendor=093a, idProduct=2622, bcdDevice=b7.89 [ 2176.521811][T26477] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2176.530178][T26477] usb 4-1: Product: syz [ 2176.536427][T26477] usb 4-1: Manufacturer: syz [ 2176.541083][T26477] usb 4-1: SerialNumber: syz [ 2176.548580][T26477] usb 4-1: config 0 descriptor?? [ 2176.573561][ T5809] usb 1-1: device descriptor read/64, error -71 [ 2176.591307][T26477] gspca_main: gspca_pac7302-2.14.0 probing 093a:2622 [ 2176.793276][ T30] audit: type=1400 audit(1745636012.352:2704): avc: denied { ioctl } for pid=28971 comm="syz.4.5821" path="socket:[103820]" dev="sockfs" ino=103820 ioctlcmd=0x89ef scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 2176.818697][ C1] vkms_vblank_simulate: vblank timer overrun [ 2176.823035][ T5809] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 2177.018352][ T5809] usb 1-1: Using ep0 maxpacket: 8 [ 2177.028170][T28975] netlink: 596 bytes leftover after parsing attributes in process `syz.4.5822'. [ 2177.029338][ T5809] usb 1-1: config 4 has an invalid interface number: 38 but max is 0 [ 2177.070111][ T5809] usb 1-1: config 4 has no interface number 0 [ 2177.080301][ T5809] usb 1-1: config 4 interface 38 altsetting 239 endpoint 0xB has invalid maxpacket 1024, setting to 64 [ 2177.105584][ T5809] usb 1-1: config 4 interface 38 altsetting 239 endpoint 0xF has invalid wMaxPacketSize 0 [ 2177.121872][ T5809] usb 1-1: config 4 interface 38 has no altsetting 0 [ 2177.137978][ T5809] usb 1-1: New USB device found, idVendor=2001, idProduct=3a05, bcdDevice=fd.0e [ 2177.149060][ T5809] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2177.159590][ T5809] usb 1-1: Product: ᯶괉íºâŸ‡è‚ŒíŸï¸¥ç Ø®ëš®ë™ï”“æ¯ã„¨ï®—ã„뿓굸ä¾äœ ë‚–춅⟈౸⢦얔鬳ã¯æ‡¡ç–‚漢똮峻丷猬팷울⠒ꥭåžäº–궤푒굯ä¦çˆÞ¯å©·åŒã¥ˆáº—ৈ갧êŸæ£°ä¿©Ã–ᴫ붭å¥é¶Šá©è¾µæµƒà´®á¾¢éˆœç†½ÛšäŽê¯…è¹é«¯ë¼¸â§Œ [ 2177.190298][ T5809] usb 1-1: Manufacturer: ä€ [ 2177.195303][ T5809] usb 1-1: SerialNumber: 컊ꧭ⌕埧饰㚎⋉ᰎ褦抢숓â‹Ò½â”µç“¡é˜–漪걓幤紋ꊥ㢺ⶕꆺ䖨焥ꢉ醹 [ 2177.228452][T25470] IPVS: stop unused estimator thread 0... [ 2177.425769][T26477] input: gspca_pac7302 as /devices/platform/dummy_hcd.3/usb4/4-1/input/input104 [ 2177.459392][ T5809] usb 1-1: Could not find all expected endpoints [ 2177.498887][ T5809] usb 1-1: USB disconnect, device number 4 [ 2177.679233][ T5863] usb 4-1: USB disconnect, device number 112 [ 2177.931738][T28844] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 2177.943703][T28844] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 2177.957579][T28844] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 2177.975156][T28844] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 2178.620259][T28844] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2179.089893][T28844] 8021q: adding VLAN 0 to HW filter on device team0 [ 2179.129293][T10965] bridge0: port 1(bridge_slave_0) entered blocking state [ 2179.136471][T10965] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2179.153126][ T5898] usb 4-1: new low-speed USB device number 113 using dummy_hcd [ 2179.223618][T10965] bridge0: port 2(bridge_slave_1) entered blocking state [ 2179.230822][T10965] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2179.345140][ T5898] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2179.355772][ T5898] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2179.367121][ T5898] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2179.378066][ T5898] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2179.391044][ T5898] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2179.405896][ T5898] usb 4-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 2179.438365][ T5898] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2179.499188][ T5898] usb 4-1: config 0 descriptor?? [ 2179.763026][ T5898] usb 4-1: USB disconnect, device number 113 [ 2180.271901][ T30] audit: type=1400 audit(1745636015.832:2705): avc: denied { bind } for pid=29008 comm="syz.2.5831" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 2180.416144][T28844] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2180.514711][T28844] veth0_vlan: entered promiscuous mode [ 2180.530757][T28844] veth1_vlan: entered promiscuous mode [ 2180.766501][T28844] veth0_macvtap: entered promiscuous mode [ 2180.780140][T28844] veth1_macvtap: entered promiscuous mode [ 2180.918403][ T5863] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 2180.927654][ T5929] usb 3-1: new high-speed USB device number 125 using dummy_hcd [ 2181.157726][T28844] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2181.349364][T28844] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2181.360039][T28844] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2181.370817][T28844] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2181.381429][T28844] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2181.393539][T28844] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2181.403474][T28844] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2181.414205][T28844] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2181.424128][T28844] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2181.435064][T28844] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2181.448887][T28844] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2181.480252][T28844] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2181.495301][T28844] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2181.506477][T28844] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2181.519742][T28844] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2181.531432][T28844] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2181.549840][T28844] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2181.560172][T28844] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2181.573804][T28844] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2181.583994][T28844] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2181.600870][T28844] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2181.612707][T28844] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2181.631478][T28844] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2181.640814][T28844] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2181.654785][T28844] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2181.666297][T28844] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2181.906294][ T4346] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2181.907976][ T5929] usb 3-1: Using ep0 maxpacket: 16 [ 2181.921531][ T5863] usb 1-1: Using ep0 maxpacket: 16 [ 2181.938967][ T5929] usb 3-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2181.952670][ T5863] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2181.963382][ T5929] usb 3-1: config 0 interface 0 altsetting 16 endpoint 0x2 has an invalid bInterval 129, changing to 11 [ 2181.976790][ T5863] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x2 has an invalid bInterval 129, changing to 11 [ 2181.983436][ T4346] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2181.988778][ T5929] usb 3-1: config 0 interface 0 altsetting 16 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 2182.010837][ T5863] usb 1-1: config 0 interface 0 altsetting 16 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 2182.034688][ T5863] usb 1-1: config 0 interface 0 has no altsetting 0 [ 2182.042660][ T5929] usb 3-1: config 0 interface 0 has no altsetting 0 [ 2182.051552][T25470] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2182.060437][T25470] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2182.068505][ T5863] usb 1-1: New USB device found, idVendor=1e71, idProduct=2010, bcdDevice= 0.00 [ 2182.081156][ T5929] usb 3-1: New USB device found, idVendor=1e71, idProduct=2010, bcdDevice= 0.00 [ 2182.117071][ T5863] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2182.380000][ T5929] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2182.561158][ T5863] usb 1-1: config 0 descriptor?? [ 2182.574179][ T5929] usb 3-1: config 0 descriptor?? [ 2183.359070][ T5929] nzxt-smart2 0003:1E71:2010.0020: unknown main item tag 0x0 [ 2183.377412][ T5863] nzxt-smart2 0003:1E71:2010.0021: unknown main item tag 0x0 [ 2184.015960][T29052] netlink: 'syz.1.5843': attribute type 10 has an invalid length. [ 2184.086541][ T5929] nzxt-smart2 0003:1E71:2010.0020: unknown main item tag 0x0 [ 2184.094772][ T5863] nzxt-smart2 0003:1E71:2010.0021: unknown main item tag 0x0 [ 2184.103822][ T5863] nzxt-smart2 0003:1E71:2010.0021: unknown main item tag 0x0 [ 2184.108341][ T5898] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 2184.111787][ T5863] nzxt-smart2 0003:1E71:2010.0021: unknown main item tag 0x0 [ 2184.127119][ T5929] nzxt-smart2 0003:1E71:2010.0020: unknown main item tag 0x0 [ 2184.135860][ T5929] nzxt-smart2 0003:1E71:2010.0020: unknown main item tag 0x0 [ 2184.144089][ T5929] nzxt-smart2 0003:1E71:2010.0020: unknown main item tag 0x0 [ 2184.144386][T29052] syz_tun: entered promiscuous mode [ 2184.153034][ T5863] nzxt-smart2 0003:1E71:2010.0021: unknown main item tag 0x0 [ 2184.172045][ T5929] nzxt-smart2 0003:1E71:2010.0020: hidraw0: USB HID v0.05 Device [HID 1e71:2010] on usb-dummy_hcd.2-1/input0 [ 2184.176247][T29052] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 2184.197019][ T5863] nzxt-smart2 0003:1E71:2010.0021: hidraw1: USB HID v0.05 Device [HID 1e71:2010] on usb-dummy_hcd.0-1/input0 [ 2184.509625][T29057] 9pnet_fd: Insufficient options for proto=fd [ 2184.543103][T17622] usb 4-1: new low-speed USB device number 114 using dummy_hcd [ 2184.553040][ T5898] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2184.618724][ T5898] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2184.629135][ T5898] usb 5-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00 [ 2184.904949][ T5898] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2184.920003][ T5929] usb 3-1: USB disconnect, device number 125 [ 2184.930520][ T5863] usb 1-1: USB disconnect, device number 5 [ 2185.113721][ T5898] usb 5-1: config 0 descriptor?? [ 2185.139040][T17622] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2185.155999][T17622] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2185.173861][T17622] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2185.470189][T17622] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2185.481796][T17622] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2185.612072][T17622] usb 4-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 2185.631696][T17622] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2186.128878][T17622] usb 4-1: config 0 descriptor?? [ 2186.137465][T29047] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2186.164563][T29047] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2186.356895][T17622] usb 4-1: USB disconnect, device number 114 [ 2186.474157][T10009] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 2186.532613][ T5898] usbhid 5-1:0.0: can't add hid device: -71 [ 2186.540477][ T5898] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 2186.557738][ T5898] usb 5-1: USB disconnect, device number 7 [ 2186.634742][T10009] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 2186.662810][T10009] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 2186.679034][T10009] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2186.702750][T10009] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 2186.717071][T10009] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2186.726011][T10009] usb 2-1: Product: syz [ 2186.730301][T29084] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(4) [ 2186.736817][T29084] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 2186.748138][T10009] usb 2-1: Manufacturer: syz [ 2186.752772][T10009] usb 2-1: SerialNumber: syz [ 2186.761220][T29084] vhci_hcd vhci_hcd.0: Device attached [ 2186.774662][T29085] vhci_hcd: connection closed [ 2186.775079][T25470] vhci_hcd: stop threads [ 2186.784972][T25470] vhci_hcd: release socket [ 2186.789417][T25470] vhci_hcd: disconnect device [ 2186.973785][T10009] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 107 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 2187.011611][T10009] usb 2-1: USB disconnect, device number 107 [ 2187.033879][T10009] usblp0: removed [ 2187.215939][ T5863] usb 4-1: new high-speed USB device number 115 using dummy_hcd [ 2187.643244][T29098] netlink: 'syz.0.5855': attribute type 10 has an invalid length. [ 2187.650520][T29100] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5856'. [ 2187.660745][ T5863] usb 4-1: Using ep0 maxpacket: 16 [ 2187.675063][ T5863] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD7, changing to 0x87 [ 2187.719967][ T5863] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 2188.018023][ T5863] usb 4-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 2188.029422][ T5863] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2188.456099][ T30] audit: type=1400 audit(1745636023.812:2706): avc: denied { listen } for pid=29099 comm="syz.2.5856" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 2188.707886][ T5863] usb 4-1: Product: syz [ 2188.712499][ T5863] usb 4-1: Manufacturer: syz [ 2188.717561][ T5863] usb 4-1: SerialNumber: syz [ 2188.765884][ T5863] usb 4-1: config 0 descriptor?? [ 2189.193116][ T5863] appledisplay 4-1:0.0: Error while getting initial brightness: -110 [ 2189.202148][ T5863] appledisplay 4-1:0.0: probe with driver appledisplay failed with error -110 [ 2189.293816][ T5929] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 2189.552980][ T5929] usb 5-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 2189.553036][ T5929] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2189.704485][ T5929] usb 5-1: config 0 descriptor?? [ 2189.708096][ T5929] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 2189.738737][T29088] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5852'. [ 2189.852574][T29088] SELinux: policydb magic number 0x616e6572 does not match expected magic number 0xf97cff8c [ 2189.852675][T29088] SELinux: failed to load policy [ 2189.864507][T17622] usb 4-1: USB disconnect, device number 115 [ 2190.114228][ T5863] usb 1-1: new low-speed USB device number 6 using dummy_hcd [ 2190.124908][ T5929] cpia1 5-1:0.0: unexpected state after lo power cmd: 00 [ 2190.734840][T29103] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5857'. [ 2190.756775][ T5863] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2190.770462][ T5929] gspca_cpia1: usb_control_msg 02, error -71 [ 2190.778503][ T5929] gspca_cpia1: usb_control_msg 05, error -71 [ 2190.785316][ T5929] cpia1 5-1:0.0: unexpected systemstate: 00 [ 2191.001920][ T5863] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2191.018655][T29137] netlink: 76 bytes leftover after parsing attributes in process `syz.2.5865'. [ 2191.035403][ T5929] usb 5-1: USB disconnect, device number 8 [ 2191.047946][ T5863] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2191.081993][ T5863] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2191.097144][ T5863] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2191.112268][ T5863] usb 1-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 2191.124058][ T5863] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2191.252153][T29143] netlink: 76 bytes leftover after parsing attributes in process `syz.3.5866'. [ 2191.274698][ T5863] usb 1-1: config 0 descriptor?? [ 2191.509339][T10009] usb 1-1: USB disconnect, device number 6 [ 2192.915510][T17622] kernel write not supported for file /cpu/0/msr (pid: 17622 comm: kworker/0:5) [ 2193.328956][T29171] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5874'. [ 2193.424008][T10009] kernel write not supported for file /cpu/0/msr (pid: 10009 comm: kworker/0:0) [ 2194.453868][T29182] xt_policy: neither incoming nor outgoing policy selected [ 2194.490489][T29182] 9pnet_fd: Insufficient options for proto=fd [ 2194.887298][T29183] netlink: 76 bytes leftover after parsing attributes in process `syz.0.5877'. [ 2194.914620][T29186] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5879'. [ 2195.915552][T29197] 9pnet_fd: Insufficient options for proto=fd [ 2196.671231][T10009] usb 5-1: new low-speed USB device number 9 using dummy_hcd [ 2197.105671][T10009] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2197.138367][T10009] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2197.180690][T10009] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2197.207688][T10009] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2197.222213][T10009] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2197.232494][T10009] usb 5-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 2197.244953][T10009] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2197.258900][T10009] usb 5-1: config 0 descriptor?? [ 2197.454871][ T5929] usb 4-1: new high-speed USB device number 116 using dummy_hcd [ 2197.504232][T10009] usb 5-1: USB disconnect, device number 9 [ 2197.644140][ T5929] usb 4-1: Using ep0 maxpacket: 8 [ 2197.681268][ T5929] usb 4-1: config 1 has an invalid interface number: 133 but max is 0 [ 2197.843738][ T5929] usb 4-1: config 1 has no interface number 0 [ 2197.850191][ T5929] usb 4-1: config 1 interface 133 has no altsetting 0 [ 2197.997085][ T5929] usb 4-1: New USB device found, idVendor=1199, idProduct=6812, bcdDevice=7a.33 [ 2198.018489][ T5929] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2198.030672][T29218] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5888'. [ 2198.069366][T29218] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5888'. [ 2198.069398][ T5929] usb 4-1: Product: syz [ 2198.098877][ T5929] usb 4-1: Manufacturer: syz [ 2198.104951][ T5929] usb 4-1: SerialNumber: syz [ 2198.126744][T29219] sg_write: process 1823 (syz.0.5888) changed security contexts after opening file descriptor, this is not allowed. [ 2198.164284][T29218] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5888'. [ 2198.409115][T29224] netlink: 76 bytes leftover after parsing attributes in process `syz.2.5890'. [ 2199.244153][T29234] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5886'. [ 2199.253910][T29140] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 2199.579984][T29140] usb 5-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 2199.601177][T29140] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2199.834948][T29140] usb 5-1: Product: syz [ 2199.865221][T29140] usb 5-1: Manufacturer: syz [ 2199.896784][T29140] usb 5-1: SerialNumber: syz [ 2200.002544][T29140] usb 5-1: config 0 descriptor?? [ 2200.032105][T29140] ch341 5-1:0.0: ch341-uart converter detected [ 2200.073048][T10009] usb 3-1: new high-speed USB device number 126 using dummy_hcd [ 2200.273099][T10009] usb 3-1: Using ep0 maxpacket: 8 [ 2200.321251][T29246] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 2200.726918][T29140] usb 5-1: failed to receive control message: -121 [ 2200.734849][T29140] ch341-uart ttyUSB0: probe with driver ch341-uart failed with error -121 [ 2200.818764][T10009] usb 3-1: config 1 has an invalid interface number: 133 but max is 0 [ 2200.932185][T10009] usb 3-1: config 1 has no interface number 0 [ 2200.959770][T10009] usb 3-1: config 1 interface 133 has no altsetting 0 [ 2200.989045][T10009] usb 3-1: New USB device found, idVendor=1199, idProduct=6812, bcdDevice=7a.33 [ 2201.001738][T10009] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2201.028769][ T5898] usb 5-1: USB disconnect, device number 10 [ 2201.035892][ T5898] ch341 5-1:0.0: device disconnected [ 2201.075958][T10009] usb 3-1: Product: syz [ 2201.080287][T10009] usb 3-1: Manufacturer: syz [ 2201.090217][T10009] usb 3-1: SerialNumber: syz [ 2201.187554][ T5929] sierra 4-1:1.133: Sierra USB modem converter detected [ 2201.218604][ T5929] usb 4-1: Sierra USB modem converter now attached to ttyUSB0 [ 2201.261970][ T5929] usb 4-1: USB disconnect, device number 116 [ 2201.284010][ T5929] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 2201.311141][ T5929] sierra 4-1:1.133: device disconnected [ 2201.974398][T29259] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5896'. [ 2202.118085][T29263] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 2202.424443][ T81] usb 5-1: new low-speed USB device number 11 using dummy_hcd [ 2202.776534][ T81] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2202.806548][ T81] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2203.101547][ T81] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2203.138818][ T81] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2203.281848][ T81] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2203.292956][ T81] usb 5-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 2203.304033][ T81] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2203.316800][ T81] usb 5-1: config 0 descriptor?? [ 2203.333087][ T30] audit: type=1400 audit(1745636038.862:2707): avc: denied { write } for pid=29269 comm="syz.3.5903" path="socket:[105266]" dev="sockfs" ino=105266 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 2203.438864][T29272] netlink: 76 bytes leftover after parsing attributes in process `syz.1.5904'. [ 2203.562103][ T5898] usb 5-1: USB disconnect, device number 11 [ 2203.874029][ T81] usb 2-1: new high-speed USB device number 108 using dummy_hcd [ 2203.894074][T17622] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 2204.185159][ T81] usb 2-1: Using ep0 maxpacket: 16 [ 2204.193112][ T81] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD7, changing to 0x87 [ 2204.206563][ T81] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 2204.262099][ T81] usb 2-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 2204.288954][T26477] usb 4-1: new high-speed USB device number 117 using dummy_hcd [ 2204.293022][ T81] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2204.305160][T17622] usb 1-1: Using ep0 maxpacket: 16 [ 2204.312559][T17622] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2204.327020][T17622] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x2 has an invalid bInterval 129, changing to 11 [ 2204.345237][T17622] usb 1-1: config 0 interface 0 altsetting 16 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 2204.345397][ T81] usb 2-1: Product: syz [ 2204.362185][T17622] usb 1-1: config 0 interface 0 has no altsetting 0 [ 2204.371761][ T81] usb 2-1: Manufacturer: syz [ 2204.381487][T17622] usb 1-1: New USB device found, idVendor=1e71, idProduct=2010, bcdDevice= 0.00 [ 2204.383006][ T81] usb 2-1: SerialNumber: syz [ 2204.392817][T17622] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2204.422504][ T81] usb 2-1: config 0 descriptor?? [ 2204.429664][T17622] usb 1-1: config 0 descriptor?? [ 2204.437840][T10009] sierra 3-1:1.133: Sierra USB modem converter detected [ 2204.455942][T10009] usb 3-1: Sierra USB modem converter now attached to ttyUSB0 [ 2204.469884][T10009] usb 3-1: USB disconnect, device number 126 [ 2204.491700][T26477] usb 4-1: Using ep0 maxpacket: 32 [ 2204.532396][T10009] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 2204.548587][T26477] usb 4-1: config 0 has an invalid descriptor of length 1, skipping remainder of the config [ 2204.559809][T10009] sierra 3-1:1.133: device disconnected [ 2204.566068][T26477] usb 4-1: config 0 has no interfaces? [ 2204.578629][T26477] usb 4-1: New USB device found, idVendor=05dc, idProduct=0001, bcdDevice= 0.01 [ 2204.588196][T26477] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2204.596321][T26477] usb 4-1: Product: syz [ 2204.600728][T26477] usb 4-1: Manufacturer: syz [ 2204.605414][T26477] usb 4-1: SerialNumber: syz [ 2204.612879][T26477] usb 4-1: config 0 descriptor?? [ 2204.718004][ T81] appledisplay 2-1:0.0: Error while getting initial brightness: -110 [ 2204.721990][ T81] appledisplay 2-1:0.0: probe with driver appledisplay failed with error -110 [ 2204.864066][T10009] usb 3-1: new high-speed USB device number 127 using dummy_hcd [ 2205.218336][T17622] nzxt-smart2 0003:1E71:2010.0022: unknown main item tag 0x0 [ 2205.242289][T17622] nzxt-smart2 0003:1E71:2010.0022: unknown main item tag 0x0 [ 2205.248093][T29276] SELinux: policydb magic number 0x616e6572 does not match expected magic number 0xf97cff8c [ 2205.259683][T26477] usb 4-1: USB disconnect, device number 117 [ 2205.262378][T29276] SELinux: failed to load policy [ 2205.266977][T17622] nzxt-smart2 0003:1E71:2010.0022: unknown main item tag 0x0 [ 2205.312238][T17622] nzxt-smart2 0003:1E71:2010.0022: unknown main item tag 0x0 [ 2205.320456][T17622] nzxt-smart2 0003:1E71:2010.0022: unknown main item tag 0x0 [ 2205.333790][ T5898] usb 2-1: USB disconnect, device number 108 [ 2205.343696][T10009] usb 3-1: Using ep0 maxpacket: 16 [ 2205.349809][T17622] nzxt-smart2 0003:1E71:2010.0022: hidraw0: USB HID v0.05 Device [HID 1e71:2010] on usb-dummy_hcd.0-1/input0 [ 2205.363085][T10009] usb 3-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2205.373773][T10009] usb 3-1: config 0 interface 0 altsetting 16 endpoint 0x2 has an invalid bInterval 129, changing to 11 [ 2205.388243][T10009] usb 3-1: config 0 interface 0 altsetting 16 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 2205.402155][T10009] usb 3-1: config 0 interface 0 has no altsetting 0 [ 2205.603216][T10009] usb 3-1: New USB device found, idVendor=1e71, idProduct=2010, bcdDevice= 0.00 [ 2205.612688][T10009] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2205.624396][T10009] usb 3-1: config 0 descriptor?? [ 2205.987556][T17622] usb 1-1: USB disconnect, device number 7 [ 2206.195145][T10009] nzxt-smart2 0003:1E71:2010.0023: unknown main item tag 0x0 [ 2206.202623][T10009] nzxt-smart2 0003:1E71:2010.0023: unknown main item tag 0x0 [ 2206.272309][T10009] nzxt-smart2 0003:1E71:2010.0023: unknown main item tag 0x0 [ 2206.393842][T10009] nzxt-smart2 0003:1E71:2010.0023: unknown main item tag 0x0 [ 2206.613658][T10009] nzxt-smart2 0003:1E71:2010.0023: unknown main item tag 0x0 [ 2207.022896][T10009] nzxt-smart2 0003:1E71:2010.0023: hidraw0: USB HID v0.05 Device [HID 1e71:2010] on usb-dummy_hcd.2-1/input0 [ 2207.138619][T10009] usb 3-1: USB disconnect, device number 127 [ 2207.844827][T29317] netlink: 76 bytes leftover after parsing attributes in process `syz.4.5917'. [ 2208.092214][T17622] kernel write not supported for file /cpu/0/msr (pid: 17622 comm: kworker/0:5) [ 2208.383234][ T81] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 2208.443025][T10009] usb 4-1: new low-speed USB device number 118 using dummy_hcd [ 2208.540660][T29334] netlink: 76 bytes leftover after parsing attributes in process `syz.4.5923'. [ 2208.575574][ T81] usb 3-1: Using ep0 maxpacket: 16 [ 2208.608278][ T81] usb 3-1: config 0 interface 0 has no altsetting 0 [ 2208.640818][T10009] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2208.656421][ T81] usb 3-1: New USB device found, idVendor=0458, idProduct=5013, bcdDevice= 0.00 [ 2208.665709][T10009] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2208.666592][T10009] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2208.677673][T10009] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2208.723748][T10009] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2208.778642][ T81] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2208.789813][T10009] usb 4-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 2208.862394][T10009] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2208.863073][ T81] usb 3-1: config 0 descriptor?? [ 2208.923894][T10009] usb 4-1: config 0 descriptor?? [ 2209.266591][T29140] usb 4-1: USB disconnect, device number 118 [ 2209.459158][ T81] hid (null): unknown global tag 0xe [ 2209.563271][T10009] usb 2-1: new high-speed USB device number 109 using dummy_hcd [ 2209.709289][ T81] input: HID 0458:5013 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0458:5013.0024/input/input105 [ 2209.712000][T29348] netlink: 'syz.0.5929': attribute type 10 has an invalid length. [ 2209.723660][T29325] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2209.733737][T10009] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2209.753199][T29325] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2209.761864][T10009] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2209.766228][T29325] netlink: 40 bytes leftover after parsing attributes in process `syz.2.5922'. [ 2209.819826][T10009] usb 2-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 2209.830980][T29349] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2209.850954][T10009] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2209.855864][ T81] input: HID 0458:5013 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0458:5013.0024/input/input106 [ 2209.869935][T29349] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2209.881665][T10009] usb 2-1: config 0 descriptor?? [ 2209.892510][ T30] audit: type=1400 audit(1745636045.462:2708): avc: denied { connect } for pid=29350 comm="syz.0.5930" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 2210.004186][T29325] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2210.013077][T29325] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2210.097620][ T81] kye 0003:0458:5013.0024: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0458:5013] on usb-dummy_hcd.2-1/input0 [ 2210.301995][T10009] cp2112 0003:10C4:EA90.0025: item fetching failed at offset 5/7 [ 2210.320446][ T81] usb 3-1: USB disconnect, device number 2 [ 2210.323696][T10009] cp2112 0003:10C4:EA90.0025: parse failed [ 2210.561003][T10009] cp2112 0003:10C4:EA90.0025: probe with driver cp2112 failed with error -22 [ 2211.591812][T29375] netlink: 76 bytes leftover after parsing attributes in process `syz.0.5934'. [ 2212.156842][T29378] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 2212.736978][T29391] netlink: 'syz.0.5940': attribute type 10 has an invalid length. [ 2213.468274][T10009] usb 4-1: new low-speed USB device number 119 using dummy_hcd [ 2213.882690][T10009] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2213.905474][T10009] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2213.909886][ T5929] usb 2-1: USB disconnect, device number 109 [ 2214.394670][T10009] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2214.493062][T10009] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2214.512490][T10009] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2214.568205][T10009] usb 4-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 2214.584278][T10009] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2214.673070][T29416] xt_policy: neither incoming nor outgoing policy selected [ 2214.700335][T29416] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5947'. [ 2214.771505][T29417] 9pnet_fd: Insufficient options for proto=fd [ 2215.076940][T10009] usb 4-1: config 0 descriptor?? [ 2215.305110][ T5898] usb 4-1: USB disconnect, device number 119 [ 2215.383188][ T5929] usb 2-1: new high-speed USB device number 110 using dummy_hcd [ 2215.471783][T29430] netlink: 76 bytes leftover after parsing attributes in process `syz.2.5950'. [ 2215.533993][T29428] wg2: left promiscuous mode [ 2215.538805][T29428] wg2: left allmulticast mode [ 2215.583368][ T5929] usb 2-1: Using ep0 maxpacket: 8 [ 2215.601173][ T5929] usb 2-1: config 1 has an invalid interface number: 133 but max is 0 [ 2215.621418][ T5929] usb 2-1: config 1 has no interface number 0 [ 2215.645163][T10009] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 2215.676470][ T5929] usb 2-1: config 1 interface 133 has no altsetting 0 [ 2215.697307][ T5929] usb 2-1: New USB device found, idVendor=1199, idProduct=6812, bcdDevice=7a.33 [ 2215.699341][T29428] veth0_vlan: left allmulticast mode [ 2215.722707][ T5929] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2215.736504][ T5929] usb 2-1: Product: syz [ 2215.741256][ T5929] usb 2-1: Manufacturer: syz [ 2215.746625][ T5929] usb 2-1: SerialNumber: syz [ 2215.800942][T29428] macvlan0: left promiscuous mode [ 2215.816716][T29428] macvlan0: left allmulticast mode [ 2215.836750][T10009] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2215.860695][T10009] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 2215.938682][T29428] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2215.958139][T10009] usb 1-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 2215.963213][T29428] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2215.984066][T29428] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2215.997990][T29428] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2216.124136][T10009] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2216.149553][T29428] netdevsim netdevsim4 netdevsim0: left promiscuous mode [ 2216.465617][T29440] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5948'. [ 2216.568537][T10009] usb 1-1: config 0 descriptor?? [ 2216.603811][T10009] hdpvr 1-1:0.0: Could not find bulk-in endpoint [ 2216.616298][T10009] hdpvr 1-1:0.0: probe with driver hdpvr failed with error -12 [ 2216.760813][T29428] macvlan2: left promiscuous mode [ 2216.769408][T29428] macvlan2: left allmulticast mode [ 2216.798708][T29428] macvlan3: left promiscuous mode [ 2216.960240][T29428] macvlan3: left allmulticast mode [ 2216.974316][T29428] macvlan4: left promiscuous mode [ 2216.992695][T29428] macvlan4: left allmulticast mode [ 2217.026666][T29428] macvlan5: left promiscuous mode [ 2217.040393][T29428] macvlan5: left allmulticast mode [ 2217.073194][T29428] bond0: left allmulticast mode [ 2217.100938][T29428] bond0: left promiscuous mode [ 2217.124576][T29428] macvlan6: left promiscuous mode [ 2217.129884][T29428] macvlan6: left allmulticast mode [ 2217.142388][T29428] ip6erspan0: left promiscuous mode [ 2217.210806][ T5929] sierra 2-1:1.133: Sierra USB modem converter detected [ 2217.246813][T29449] netlink: 'syz.4.5953': attribute type 10 has an invalid length. [ 2217.265735][T29449] syz_tun: entered promiscuous mode [ 2217.295289][T29449] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 2217.305503][T29422] i2c i2c-0: Invalid block write size 34 [ 2217.315944][T26477] usb 1-1: USB disconnect, device number 8 [ 2217.325658][ T5929] usb 2-1: Sierra USB modem converter now attached to ttyUSB0 [ 2217.355523][ T5929] usb 2-1: USB disconnect, device number 110 [ 2217.386882][ T5929] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 2217.409675][ T5929] sierra 2-1:1.133: device disconnected [ 2217.788381][ T30] audit: type=1400 audit(1745636053.352:2709): avc: denied { append } for pid=29454 comm="syz.3.5955" name="sg0" dev="devtmpfs" ino=753 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 2218.804231][ T10] kernel write not supported for file /cpu/0/msr (pid: 10 comm: kworker/0:1) [ 2219.165130][T29472] wg2: entered promiscuous mode [ 2219.170036][T29472] wg2: entered allmulticast mode [ 2219.533087][ T5929] usb 1-1: new full-speed USB device number 9 using dummy_hcd [ 2219.695590][ T5929] usb 1-1: config 5 has an invalid interface number: 234 but max is 0 [ 2219.723379][ T5929] usb 1-1: config 5 has no interface number 0 [ 2219.740705][ T5929] usb 1-1: config 5 interface 234 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 2219.809319][T29487] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 2220.035105][T29140] usb 5-1: new low-speed USB device number 12 using dummy_hcd [ 2220.273821][ T5929] usb 1-1: New USB device found, idVendor=0bfd, idProduct=0027, bcdDevice=6e.03 [ 2220.303072][ T5929] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2220.313129][ T5929] usb 1-1: Product: syz [ 2220.322245][ T5929] usb 1-1: Manufacturer: syz [ 2220.339014][ T5929] usb 1-1: SerialNumber: syz [ 2220.356818][T29474] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 2220.369196][ T5929] kvaser_usb 1-1:5.234: error -EPROTO: Cannot get software info [ 2220.389719][ T5929] kvaser_usb 1-1:5.234: probe with driver kvaser_usb failed with error -71 [ 2220.435090][T29140] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2220.459081][T29140] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2220.487266][T29140] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2220.508361][T29140] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2220.554109][T29140] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2220.609588][T29140] usb 5-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 2220.634628][T29140] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2220.933400][T29474] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2220.956244][ T5929] usb 1-1: USB disconnect, device number 9 [ 2220.964837][T29494] IPVS: sync thread started: state = BACKUP, mcast_ifn = sit0, syncid = 0, id = 0 [ 2220.982119][T29490] netlink: 'syz.1.5964': attribute type 10 has an invalid length. [ 2221.007232][T29140] usb 5-1: config 0 descriptor?? [ 2221.118347][T29498] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5967'. [ 2221.240138][ T10] usb 5-1: USB disconnect, device number 12 [ 2221.407503][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 2221.413982][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 2221.799628][ T30] audit: type=1400 audit(1745636057.362:2710): avc: denied { accept } for pid=29506 comm="syz.0.5970" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 2221.830779][T26477] usb 2-1: new high-speed USB device number 111 using dummy_hcd [ 2222.085294][T26477] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2222.106543][T29510] FAULT_INJECTION: forcing a failure. [ 2222.106543][T29510] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2222.120070][T29510] CPU: 0 UID: 0 PID: 29510 Comm: syz.2.5971 Not tainted 6.15.0-rc3-syzkaller-00094-g02ddfb981de8 #0 PREEMPT(full) [ 2222.120094][T29510] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 2222.120104][T29510] Call Trace: [ 2222.120110][T29510] [ 2222.120116][T29510] dump_stack_lvl+0x16c/0x1f0 [ 2222.120141][T29510] should_fail_ex+0x512/0x640 [ 2222.120166][T29510] _copy_from_user+0x2e/0xd0 [ 2222.120195][T29510] copy_msghdr_from_user+0x98/0x160 [ 2222.120219][T29510] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 2222.120246][T29510] ? kfree+0x252/0x4d0 [ 2222.120267][T29510] ? __pfx__kstrtoull+0x10/0x10 [ 2222.120284][T29510] ___sys_sendmsg+0xfe/0x1d0 [ 2222.120305][T29510] ? __pfx____sys_sendmsg+0x10/0x10 [ 2222.120350][T29510] ? __pfx___might_resched+0x10/0x10 [ 2222.120377][T29510] __sys_sendmmsg+0x200/0x420 [ 2222.120403][T29510] ? __pfx___sys_sendmmsg+0x10/0x10 [ 2222.120446][T29510] ? __might_fault+0xe3/0x190 [ 2222.120461][T29510] ? __might_fault+0xe3/0x190 [ 2222.120475][T29510] ? __might_fault+0x13b/0x190 [ 2222.120497][T29510] __x64_sys_sendmmsg+0x9c/0x100 [ 2222.120520][T29510] do_syscall_64+0xcd/0x260 [ 2222.120553][T29510] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2222.120569][T29510] RIP: 0033:0x7f8d62d8e969 [ 2222.120584][T29510] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2222.120599][T29510] RSP: 002b:00007f8d63b5c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 2222.120616][T29510] RAX: ffffffffffffffda RBX: 00007f8d62fb5fa0 RCX: 00007f8d62d8e969 [ 2222.120627][T29510] RDX: 0000000004000095 RSI: 0000200000005240 RDI: 0000000000000005 [ 2222.120637][T29510] RBP: 00007f8d63b5c090 R08: 0000000000000000 R09: 0000000000000000 [ 2222.120647][T29510] R10: 00000000000000f4 R11: 0000000000000246 R12: 0000000000000001 [ 2222.120657][T29510] R13: 0000000000000000 R14: 00007f8d62fb5fa0 R15: 00007ffee4012bb8 [ 2222.120679][T29510] [ 2222.312060][ C0] vkms_vblank_simulate: vblank timer overrun [ 2222.319141][ T10] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 2222.423307][T26477] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 2222.460428][T26477] usb 2-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 2222.485959][T26477] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2222.498543][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 2222.511689][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2222.529974][T26477] usb 2-1: config 0 descriptor?? [ 2222.537726][ T30] audit: type=1400 audit(1745636058.112:2711): avc: denied { watch } for pid=29515 comm="syz.4.5973" path="/575/blkio.bfq.io_merged_recursive" dev="tmpfs" ino=3286 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 2222.542053][T26477] hdpvr 2-1:0.0: Could not find bulk-in endpoint [ 2222.569614][T26477] hdpvr 2-1:0.0: probe with driver hdpvr failed with error -12 [ 2222.578882][ T10] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=7b.55 [ 2222.588469][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2222.606215][ T10] usb 1-1: Product: syz [ 2222.614989][ T10] usb 1-1: Manufacturer: syz [ 2222.619875][ T10] usb 1-1: SerialNumber: syz [ 2222.631913][ T10] usb 1-1: config 0 descriptor?? [ 2222.650657][ T10] usb 1-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 2222.753865][ T5929] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 2222.865207][T25470] usb 1-1: Failed to submit usb control message: -71 [ 2222.865382][T26477] usb 1-1: USB disconnect, device number 10 [ 2222.873191][T25470] usb 1-1: unable to send the bmi data to the device: -71 [ 2222.896917][T25470] usb 1-1: unable to get target info from device [ 2222.907314][T25470] usb 1-1: could not get target info (-71) [ 2222.918850][T25470] usb 1-1: could not probe fw (-71) [ 2222.925305][ T5929] usb 3-1: Using ep0 maxpacket: 8 [ 2222.940870][ T5929] usb 3-1: config 0 has an invalid interface number: 186 but max is 0 [ 2222.956300][ T5929] usb 3-1: config 0 has no interface number 0 [ 2222.964847][ T5929] usb 3-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 2222.990177][ T5929] usb 3-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 2223.010540][ T5929] usb 3-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 2223.028582][ T5929] usb 3-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 2223.071151][ T5929] usb 3-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 2223.085014][ T5929] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2223.097524][ T5929] usb 3-1: Product: syz [ 2223.102160][ T5929] usb 3-1: Manufacturer: syz [ 2223.110708][ T5929] usb 3-1: SerialNumber: syz [ 2223.123580][ T5929] usb 3-1: config 0 descriptor?? [ 2223.137904][T29502] i2c i2c-0: Invalid block write size 34 [ 2223.166383][T26477] usb 2-1: USB disconnect, device number 111 [ 2223.344822][ T5929] iowarrior 3-1:0.186: IOWarrior product=0x1505, serial=42424242 interface=186 now attached to iowarrior0 [ 2223.806041][ T10] usb 3-1: USB disconnect, device number 3 [ 2223.923294][T26477] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 2223.997811][T29533] xt_hashlimit: max too large, truncated to 1048576 [ 2224.087285][T26477] usb 5-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 2224.124217][T26477] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 2224.145002][T26477] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 2224.162993][T26477] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2224.183037][T26477] usb 5-1: Product: syz [ 2224.187247][T26477] usb 5-1: Manufacturer: syz [ 2224.191858][T26477] usb 5-1: SerialNumber: syz [ 2224.254462][ T10] usb 4-1: new high-speed USB device number 120 using dummy_hcd [ 2224.413335][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 2224.427067][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2224.445408][ T10] usb 4-1: New USB device found, idVendor=28de, idProduct=1102, bcdDevice= 0.00 [ 2224.460309][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2224.981355][T29548] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 2225.064398][ T10] usb 4-1: config 0 descriptor?? [ 2225.066341][T29542] ceph: No mds server is up or the cluster is laggy [ 2225.103778][T29140] libceph: connect (1)[c::]:6789 error -101 [ 2225.387977][T29140] libceph: mon0 (1)[c::]:6789 connect error [ 2225.823643][ T10] hid-steam 0003:28DE:1102.0026: unknown main item tag 0x0 [ 2225.860434][ T10] hid-steam 0003:28DE:1102.0026: unknown main item tag 0x0 [ 2225.879938][ T10] hid-steam 0003:28DE:1102.0026: unknown main item tag 0x0 [ 2225.902758][ T10] hid-steam 0003:28DE:1102.0026: unknown main item tag 0x0 [ 2225.912251][ T10] hid-steam 0003:28DE:1102.0026: unknown main item tag 0x0 [ 2226.010364][T29563] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 2226.370788][ T10] hid-steam 0003:28DE:1102.0026: hidraw0: USB HID v0.00 Device [HID 28de:1102] on usb-dummy_hcd.3-1/input0 [ 2226.434182][T29565] syz.3.5978: attempt to access beyond end of device [ 2226.434182][T29565] nbd3: rw=2048, sector=2, nr_sectors = 1 limit=0 [ 2226.716218][T26477] usb 5-1: USB disconnect, device number 13 [ 2226.867432][T29572] xt_addrtype: ipv6 BLACKHOLE matching not supported [ 2227.133294][T29572] input: syz0 as /devices/virtual/input/input107 [ 2227.234750][T29140] usb 4-1: USB disconnect, device number 120 [ 2227.349877][T29578] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5989'. [ 2227.654058][T29438] usb 2-1: new high-speed USB device number 112 using dummy_hcd [ 2227.704278][T26477] kernel write not supported for file /cpu/0/msr (pid: 26477 comm: kworker/0:4) [ 2228.145377][T29438] usb 2-1: Using ep0 maxpacket: 8 [ 2228.224838][T29438] usb 2-1: config 1 has an invalid interface number: 133 but max is 0 [ 2228.236245][T29438] usb 2-1: config 1 has no interface number 0 [ 2228.243944][T29438] usb 2-1: config 1 interface 133 has no altsetting 0 [ 2228.268246][T29438] usb 2-1: New USB device found, idVendor=1199, idProduct=6812, bcdDevice=7a.33 [ 2228.278576][T29438] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2228.300602][T29438] usb 2-1: Product: syz [ 2228.314224][T29438] usb 2-1: Manufacturer: syz [ 2228.325261][T29438] usb 2-1: SerialNumber: syz [ 2228.530187][T29597] netlink: 76 bytes leftover after parsing attributes in process `syz.0.5993'. [ 2228.573921][ T5929] usb 4-1: new high-speed USB device number 121 using dummy_hcd [ 2228.780027][T29600] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5988'. [ 2229.123539][ T5929] usb 4-1: device descriptor read/64, error -71 [ 2229.373771][T29438] sierra 2-1:1.133: Sierra USB modem converter detected [ 2229.383291][ T5929] usb 4-1: new high-speed USB device number 122 using dummy_hcd [ 2229.394980][T29438] usb 2-1: Sierra USB modem converter now attached to ttyUSB0 [ 2229.457766][T29438] usb 2-1: USB disconnect, device number 112 [ 2229.490007][T29438] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 2229.540446][T29438] sierra 2-1:1.133: device disconnected [ 2229.563432][T29437] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 2229.573076][ T5929] usb 4-1: device descriptor read/64, error -71 [ 2229.704011][ T5929] usb usb4-port1: attempt power cycle [ 2229.731820][T29608] netlink: 92 bytes leftover after parsing attributes in process `syz.2.5996'. [ 2229.762999][T29437] usb 5-1: Using ep0 maxpacket: 16 [ 2229.776432][T29437] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD7, changing to 0x87 [ 2229.799363][T29437] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 2229.836137][T29437] usb 5-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 2229.846911][T29437] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2229.862974][T29437] usb 5-1: Product: syz [ 2229.876890][T29437] usb 5-1: Manufacturer: syz [ 2229.881741][T29437] usb 5-1: SerialNumber: syz [ 2229.914524][T29437] usb 5-1: config 0 descriptor?? [ 2230.063443][ T5929] usb 4-1: new high-speed USB device number 123 using dummy_hcd [ 2230.114923][ T5929] usb 4-1: device descriptor read/8, error -71 [ 2230.193500][T29437] appledisplay 5-1:0.0: Error while getting initial brightness: -110 [ 2230.195580][T29437] appledisplay 5-1:0.0: probe with driver appledisplay failed with error -110 [ 2230.373209][ T5929] usb 4-1: new high-speed USB device number 124 using dummy_hcd [ 2230.373340][ T10] usb 2-1: new high-speed USB device number 113 using dummy_hcd [ 2230.394845][T29603] SELinux: policydb magic number 0x616e6572 does not match expected magic number 0xf97cff8c [ 2230.405113][ T5929] usb 4-1: device descriptor read/8, error -71 [ 2230.414646][T29603] SELinux: failed to load policy [ 2230.440879][T26477] usb 5-1: USB disconnect, device number 14 [ 2230.522059][ T5929] usb usb4-port1: unable to enumerate USB device [ 2230.550994][T29614] xt_policy: neither incoming nor outgoing policy selected [ 2230.606140][T29614] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5998'. [ 2230.701335][T29614] 9pnet_fd: Insufficient options for proto=fd [ 2230.758127][ T10] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 2230.816417][ T10] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2230.883064][ T10] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 2230.894188][ T10] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2230.987795][ T10] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 2231.025866][ T10] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 2231.043114][ T10] usb 2-1: Product: syz [ 2231.052390][ T10] usb 2-1: Manufacturer: syz [ 2231.081019][ T10] cdc_wdm 2-1:1.0: skipping garbage [ 2231.091681][ T10] cdc_wdm 2-1:1.0: skipping garbage [ 2231.101888][ T10] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 2231.108249][ T10] cdc_wdm 2-1:1.0: Unknown control protocol [ 2231.295665][ T10] usb 2-1: USB disconnect, device number 113 [ 2231.753018][T26477] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 2231.913235][T26477] usb 5-1: Using ep0 maxpacket: 16 [ 2231.930666][T26477] usb 5-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 2231.962617][T26477] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 2231.981281][T26477] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2232.002086][T26477] usb 5-1: Product: syz [ 2232.012728][T26477] usb 5-1: Manufacturer: syz [ 2232.027384][T26477] usb 5-1: SerialNumber: syz [ 2232.047829][T26477] usb 5-1: config 0 descriptor?? [ 2232.355180][T29631] xt_policy: neither incoming nor outgoing policy selected [ 2232.420166][T29631] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6003'. [ 2232.469822][T29631] 9pnet_fd: Insufficient options for proto=fd [ 2232.958075][T29633] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6004'. [ 2232.989728][T29633] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2233.485278][T29633] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2233.550190][T29633] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2233.638098][T29633] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2233.809210][T29646] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 2234.495453][T29616] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2234.505918][T29616] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2235.333033][T26477] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 2236.513249][T26477] usb 1-1: Using ep0 maxpacket: 16 [ 2236.537034][T26477] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2236.560076][T26477] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2236.581779][T26477] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 2236.734370][T26477] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 2236.744512][T26477] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2236.809658][T26477] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 2236.863076][T29669] xt_TPROXY: Can be used only with -p tcp or -p udp [ 2237.103568][T29675] xt_policy: neither incoming nor outgoing policy selected [ 2237.118388][T29675] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6014'. [ 2237.136052][T29675] 9pnet_fd: Insufficient options for proto=fd [ 2237.543644][T26477] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 2237.551704][T26477] usb 1-1: Manufacturer: syz [ 2237.623702][T26477] usb 1-1: config 0 descriptor?? [ 2237.643304][T26477] usb 1-1: can't set config #0, error -71 [ 2237.684027][T26477] usb 1-1: USB disconnect, device number 11 [ 2238.411033][T29437] usb 5-1: USB disconnect, device number 15 [ 2239.546106][T26477] kernel write not supported for file /cpu/0/msr (pid: 26477 comm: kworker/0:4) [ 2240.271951][T26477] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 2240.379005][ T30] audit: type=1400 audit(1745636075.772:2712): avc: denied { append } for pid=29710 comm="syz.2.6017" name="event0" dev="devtmpfs" ino=918 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 2240.402508][ C0] vkms_vblank_simulate: vblank timer overrun [ 2240.613134][T26477] usb 5-1: Using ep0 maxpacket: 16 [ 2240.883473][T26477] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD7, changing to 0x87 [ 2240.918484][T26477] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 2240.949721][T26477] usb 5-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 2240.992971][T26477] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2241.001304][T29716] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(3) [ 2241.007812][T29716] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 2241.025702][T26477] usb 5-1: Product: syz [ 2241.029914][T26477] usb 5-1: Manufacturer: syz [ 2241.119590][T26477] usb 5-1: SerialNumber: syz [ 2241.279062][T26477] usb 5-1: config 0 descriptor?? [ 2241.364877][T29716] vhci_hcd vhci_hcd.0: Device attached [ 2241.383090][T29437] usb 4-1: new high-speed USB device number 125 using dummy_hcd [ 2241.473979][T29438] vhci_hcd: vhci_device speed not set [ 2241.553158][T29437] usb 4-1: Using ep0 maxpacket: 8 [ 2241.553416][T29438] usb 39-1: new high-speed USB device number 3 using vhci_hcd [ 2241.555576][T29437] usb 4-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 2241.555631][T29437] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x93, changing to 0x83 [ 2241.555673][T29437] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 2241.555729][T29437] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 2241.558651][T29437] usb 4-1: New USB device found, idVendor=15c2, idProduct=003b, bcdDevice=66.3e [ 2241.558691][T29437] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2241.558726][T29437] usb 4-1: Product: syz [ 2241.558754][T29437] usb 4-1: Manufacturer: syz [ 2241.558781][T29437] usb 4-1: SerialNumber: syz [ 2241.567281][T29437] usb 4-1: config 0 descriptor?? [ 2241.594182][T29437] input: iMON Panel, Knob and Mouse(15c2:003b) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input108 [ 2241.674587][T26477] appledisplay 5-1:0.0: Error while getting initial brightness: -110 [ 2241.675619][T26477] appledisplay 5-1:0.0: probe with driver appledisplay failed with error -110 [ 2241.703609][T29728] md: md2 stopped. [ 2241.710930][ T30] audit: type=1400 audit(1745636077.272:2713): avc: denied { ioctl } for pid=29721 comm="syz.1.6030" path="/45/file0/file0" dev="fuse" ino=64 ioctlcmd=0x932 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 2241.824532][T29730] SELinux: policydb magic number 0x616e6572 does not match expected magic number 0xf97cff8c [ 2241.824578][T29730] SELinux: failed to load policy [ 2241.862345][T29437] imon:send_packet: packet tx failed (-71) [ 2241.870806][T29717] vhci_hcd: connection reset by peer [ 2241.873106][T29437] imon 4-1:0.0: panel buttons/knobs setup failed [ 2241.881444][T10965] vhci_hcd: stop threads [ 2241.881478][T10965] vhci_hcd: release socket [ 2241.883288][T10965] vhci_hcd: disconnect device [ 2241.995291][T29437] rc_core: IR keymap rc-imon-pad not found [ 2241.995422][T29437] Registered IR keymap rc-empty [ 2241.995520][T29437] imon 4-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 2241.995620][T29437] imon 4-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 2241.999476][T29437] imon:send_packet: packet tx failed (-71) [ 2242.039856][T29437] imon 4-1:0.0: remote input dev register failed [ 2242.040273][T29437] imon 4-1:0.0: imon_init_intf0: rc device setup failed [ 2242.099004][T29437] imon 4-1:0.0: unable to initialize intf0, err 0 [ 2242.099040][T29437] imon:imon_probe: failed to initialize context! [ 2242.099067][T29437] imon 4-1:0.0: unable to register, err -19 [ 2242.218019][T29437] usb 4-1: USB disconnect, device number 125 [ 2242.219902][T26477] usb 5-1: USB disconnect, device number 16 [ 2242.294751][T29743] FAULT_INJECTION: forcing a failure. [ 2242.294751][T29743] name failslab, interval 1, probability 0, space 0, times 0 [ 2242.294853][T29743] CPU: 1 UID: 0 PID: 29743 Comm: syz.2.6036 Not tainted 6.15.0-rc3-syzkaller-00094-g02ddfb981de8 #0 PREEMPT(full) [ 2242.294878][T29743] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 2242.294888][T29743] Call Trace: [ 2242.294894][T29743] [ 2242.294900][T29743] dump_stack_lvl+0x16c/0x1f0 [ 2242.294924][T29743] should_fail_ex+0x512/0x640 [ 2242.294958][T29743] ? __kmalloc_cache_noprof+0x57/0x3e0 [ 2242.294986][T29743] should_failslab+0xc2/0x120 [ 2242.295003][T29743] __kmalloc_cache_noprof+0x6a/0x3e0 [ 2242.295027][T29743] ? hash_netiface_create+0x36b/0x1250 [ 2242.295053][T29743] hash_netiface_create+0x36b/0x1250 [ 2242.295074][T29743] ? __nla_parse+0x40/0x60 [ 2242.295094][T29743] ? __pfx_hash_netiface_create+0x10/0x10 [ 2242.295116][T29743] ip_set_create+0x7e1/0x14d0 [ 2242.295143][T29743] ? __pfx_ip_set_create+0x10/0x10 [ 2242.295180][T29743] ? find_held_lock+0x2b/0x80 [ 2242.295208][T29743] nfnetlink_rcv_msg+0x9f9/0x1200 [ 2242.295236][T29743] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 2242.295253][T29743] ? kmem_cache_free+0x2d4/0x4d0 [ 2242.295304][T29743] ? avc_has_perm_noaudit+0x117/0x3b0 [ 2242.295343][T29743] netlink_rcv_skb+0x16a/0x440 [ 2242.295359][T29743] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 2242.295379][T29743] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 2242.295408][T29743] ? bpf_lsm_capable+0x9/0x10 [ 2242.295432][T29743] ? security_capable+0x7e/0x260 [ 2242.295451][T29743] ? ns_capable+0xd7/0x110 [ 2242.295473][T29743] nfnetlink_rcv+0x1b3/0x430 [ 2242.295491][T29743] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 2242.295508][T29743] ? netlink_deliver_tap+0x1ae/0xd30 [ 2242.295538][T29743] netlink_unicast+0x53a/0x7f0 [ 2242.295557][T29743] ? __pfx_netlink_unicast+0x10/0x10 [ 2242.295577][T29743] netlink_sendmsg+0x8d1/0xdd0 [ 2242.295596][T29743] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2242.295619][T29743] ____sys_sendmsg+0xa95/0xc70 [ 2242.295638][T29743] ? copy_msghdr_from_user+0x10a/0x160 [ 2242.295660][T29743] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2242.295683][T29743] ? irqentry_exit+0x3b/0x90 [ 2242.295700][T29743] ? lockdep_hardirqs_on+0x7c/0x110 [ 2242.295720][T29743] ___sys_sendmsg+0x134/0x1d0 [ 2242.295743][T29743] ? __pfx____sys_sendmsg+0x10/0x10 [ 2242.295796][T29743] __sys_sendmsg+0x16d/0x220 [ 2242.295818][T29743] ? __pfx___sys_sendmsg+0x10/0x10 [ 2242.295849][T29743] ? rcu_is_watching+0x12/0xc0 [ 2242.295872][T29743] do_syscall_64+0xcd/0x260 [ 2242.295893][T29743] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2242.295910][T29743] RIP: 0033:0x7f8d62d8e969 [ 2242.295924][T29743] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2242.295941][T29743] RSP: 002b:00007f8d63b5c038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2242.295957][T29743] RAX: ffffffffffffffda RBX: 00007f8d62fb5fa0 RCX: 00007f8d62d8e969 [ 2242.295969][T29743] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004 [ 2242.295979][T29743] RBP: 00007f8d63b5c090 R08: 0000000000000000 R09: 0000000000000000 [ 2242.295989][T29743] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2242.295999][T29743] R13: 0000000000000000 R14: 00007f8d62fb5fa0 R15: 00007ffee4012bb8 [ 2242.296022][T29743] [ 2242.492376][T26477] kernel write not supported for file /cpu/0/msr (pid: 26477 comm: kworker/0:4) [ 2243.714658][T29755] netlink: 'syz.2.6041': attribute type 10 has an invalid length. [ 2244.544527][ T30] audit: type=1400 audit(1745636080.112:2714): avc: denied { cmd } for pid=29769 comm="syz.0.6046" path="socket:[107848]" dev="sockfs" ino=107848 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 2244.567645][ C0] vkms_vblank_simulate: vblank timer overrun [ 2245.095129][T29777] xt_policy: neither incoming nor outgoing policy selected [ 2245.136709][T29777] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6048'. [ 2245.172392][T29777] 9pnet_fd: Insufficient options for proto=fd [ 2245.478562][T29778] netlink: 68 bytes leftover after parsing attributes in process `syz.1.6047'. [ 2246.083706][ T5809] usb 2-1: new high-speed USB device number 114 using dummy_hcd [ 2246.654706][T29438] vhci_hcd: vhci_device speed not set [ 2246.773094][T17622] kernel write not supported for file /cpu/0/msr (pid: 17622 comm: kworker/0:5) [ 2246.793025][ T5809] usb 2-1: Using ep0 maxpacket: 8 [ 2246.812799][ T5809] usb 2-1: config 1 has an invalid interface number: 133 but max is 0 [ 2246.831357][ T5809] usb 2-1: config 1 has no interface number 0 [ 2246.853030][ T5809] usb 2-1: config 1 interface 133 has no altsetting 0 [ 2246.919625][ T5809] usb 2-1: New USB device found, idVendor=1199, idProduct=6812, bcdDevice=7a.33 [ 2246.930461][ T5809] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2247.022110][T29794] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 2247.423211][ T5809] usb 2-1: Product: syz [ 2247.429914][ T5809] usb 2-1: Manufacturer: syz [ 2247.491069][ T5809] usb 2-1: SerialNumber: syz [ 2248.547756][T29806] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 2249.034863][T29809] tmpfs: Bad value for 'nr_inodes' [ 2249.145614][T29811] FAULT_INJECTION: forcing a failure. [ 2249.145614][T29811] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2249.159375][T29811] CPU: 0 UID: 0 PID: 29811 Comm: syz.0.6056 Not tainted 6.15.0-rc3-syzkaller-00094-g02ddfb981de8 #0 PREEMPT(full) [ 2249.159400][T29811] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 2249.159410][T29811] Call Trace: [ 2249.159416][T29811] [ 2249.159422][T29811] dump_stack_lvl+0x16c/0x1f0 [ 2249.159445][T29811] should_fail_ex+0x512/0x640 [ 2249.159469][T29811] _copy_to_user+0x32/0xd0 [ 2249.159492][T29811] simple_read_from_buffer+0xcb/0x170 [ 2249.159516][T29811] proc_fail_nth_read+0x197/0x270 [ 2249.159540][T29811] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2249.159563][T29811] ? rw_verify_area+0xcf/0x680 [ 2249.159584][T29811] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2249.159606][T29811] vfs_read+0x1de/0xc70 [ 2249.159631][T29811] ? __pfx___mutex_lock+0x10/0x10 [ 2249.159650][T29811] ? __pfx_vfs_read+0x10/0x10 [ 2249.159677][T29811] ? __fget_files+0x20e/0x3c0 [ 2249.159707][T29811] ksys_read+0x12a/0x240 [ 2249.159728][T29811] ? __pfx_ksys_read+0x10/0x10 [ 2249.159758][T29811] do_syscall_64+0xcd/0x260 [ 2249.159777][T29811] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2249.159792][T29811] RIP: 0033:0x7fd1e0f8d37c [ 2249.159809][T29811] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 2249.159823][T29811] RSP: 002b:00007fd1e1db9030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2249.159839][T29811] RAX: ffffffffffffffda RBX: 00007fd1e11b6160 RCX: 00007fd1e0f8d37c [ 2249.159850][T29811] RDX: 000000000000000f RSI: 00007fd1e1db90a0 RDI: 0000000000000006 [ 2249.159859][T29811] RBP: 00007fd1e1db9090 R08: 0000000000000000 R09: 0000000000000000 [ 2249.159869][T29811] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2249.159878][T29811] R13: 0000000000000001 R14: 00007fd1e11b6160 R15: 00007fffa015bdf8 [ 2249.159900][T29811] [ 2250.044062][T29438] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 2250.076668][T29827] xt_policy: neither incoming nor outgoing policy selected [ 2250.116358][T29827] 9pnet_fd: Insufficient options for proto=fd [ 2250.302139][T29438] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 32, changing to 7 [ 2250.539023][T29438] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 9277, setting to 1024 [ 2250.597599][T29438] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2250.614387][T29438] usb 3-1: New USB device found, idVendor=05ac, idProduct=030a, bcdDevice=65.8c [ 2250.672966][ T10] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 2250.679727][T29438] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2251.143540][ T30] audit: type=1400 audit(1745636086.712:2715): avc: denied { listen } for pid=29829 comm="syz.0.6064" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 2251.184838][ T10] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2251.195326][ T10] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2251.209697][ T10] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 2251.219257][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2252.373071][T17622] usb 4-1: new high-speed USB device number 126 using dummy_hcd [ 2252.549080][T17622] usb 4-1: New USB device found, idVendor=0572, idProduct=cb01, bcdDevice=26.65 [ 2252.562032][T17622] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2252.570441][T17622] usb 4-1: Product: syz [ 2252.579068][T17622] usb 4-1: Manufacturer: syz [ 2252.608810][T17622] usb 4-1: SerialNumber: syz [ 2254.003802][T29870] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.6075'. [ 2255.469872][T29881] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 2255.522015][T29881] kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 2255.535733][T29881] kvm: requested 12571 ns i8254 timer period limited to 200000 ns [ 2255.560026][T29881] kvm: requested 12571 ns i8254 timer period limited to 200000 ns [ 2255.594564][T29881] kvm: requested 85485 ns i8254 timer period limited to 200000 ns [ 2255.626307][T29881] kvm: requested 67885 ns i8254 timer period limited to 200000 ns [ 2255.635298][T29881] kvm: requested 155047 ns i8254 timer period limited to 200000 ns [ 2255.644136][T29881] kvm: requested 160914 ns i8254 timer period limited to 200000 ns [ 2255.653974][T29881] kvm: requested 44419 ns i8254 timer period limited to 200000 ns [ 2255.671590][T29881] kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 2255.795138][T18219] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 2255.809566][T18219] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 2255.821831][T18219] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 2255.834546][T18219] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 2255.846262][T18219] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 2255.886162][T29887] lo speed is unknown, defaulting to 1000 [ 2255.893338][T29887] lo speed is unknown, defaulting to 1000 [ 2256.077427][T29887] chnl_net:caif_netlink_parms(): no params data found [ 2256.757642][T29902] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6080'. [ 2256.969180][T29887] bridge0: port 1(bridge_slave_0) entered blocking state [ 2256.999193][T29887] bridge0: port 1(bridge_slave_0) entered disabled state [ 2257.026239][T29887] bridge_slave_0: entered allmulticast mode [ 2257.052473][T29887] bridge_slave_0: entered promiscuous mode [ 2257.378574][T29887] bridge0: port 2(bridge_slave_1) entered blocking state [ 2257.388660][T29887] bridge0: port 2(bridge_slave_1) entered disabled state [ 2257.486909][T29887] bridge_slave_1: entered allmulticast mode [ 2257.616297][T29887] bridge_slave_1: entered promiscuous mode [ 2257.935577][T27855] Bluetooth: hci0: command tx timeout [ 2258.217176][ T80] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2258.282531][T29887] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2258.311339][T29887] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2258.359890][ T80] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2258.451601][ T80] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2258.464481][T26477] usb 1-1: new low-speed USB device number 12 using dummy_hcd [ 2258.511297][T29887] team0: Port device team_slave_0 added [ 2258.546559][ T80] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2258.570805][T29887] team0: Port device team_slave_1 added [ 2258.626535][T26477] usb 1-1: LPM exit latency is zeroed, disabling LPM. [ 2258.638779][T29887] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2258.649588][T29887] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2258.649955][T26477] usb 1-1: config 1 interface 0 altsetting 7 endpoint 0x82 is Bulk; changing to Interrupt [ 2258.677953][T29887] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2258.701115][T26477] usb 1-1: config 1 interface 0 altsetting 7 endpoint 0x3 is Bulk; changing to Interrupt [ 2258.705821][T29887] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2258.712071][T26477] usb 1-1: config 1 interface 0 has no altsetting 0 [ 2258.727543][T29887] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2258.730725][T26477] usb 1-1: string descriptor 0 read error: -22 [ 2258.761285][T26477] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2258.764833][T29887] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2258.770477][T26477] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2258.857898][T29887] hsr_slave_0: entered promiscuous mode [ 2258.868314][T29887] hsr_slave_1: entered promiscuous mode [ 2258.875000][T29887] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 2258.883279][T29887] Cannot create hsr debugfs directory [ 2259.113229][ T80] bond1 (unregistering): (slave gretap1): Releasing active interface [ 2259.317076][ T80] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2259.331263][ T80] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2259.342306][ T80] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 2259.356390][ T80] bond0 (unregistering): Released all slaves [ 2259.480618][ T80] bond1 (unregistering): Released all slaves [ 2260.013525][T27855] Bluetooth: hci0: command tx timeout [ 2262.093081][T27855] Bluetooth: hci0: command tx timeout [ 2264.173113][T27855] Bluetooth: hci0: command tx timeout [ 2268.981955][T18219] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 2268.991002][T18219] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 2269.001554][T18219] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 2269.011653][T18219] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 2269.024985][T18219] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 2271.053289][T27855] Bluetooth: hci3: command tx timeout [ 2273.133109][T27855] Bluetooth: hci3: command tx timeout [ 2275.213148][T27855] Bluetooth: hci3: command tx timeout [ 2276.519600][T18219] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 2276.528670][T18219] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 2276.537921][T18219] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 2276.547294][T18219] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 2276.557385][T18219] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 2277.293035][T27855] Bluetooth: hci3: command tx timeout [ 2277.648395][T18219] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 2277.668059][T29949] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 2277.668104][T29950] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 2277.686971][T29950] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 2277.690345][T29949] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 2277.700444][T29950] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 2277.706035][T29949] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 2277.714173][T29950] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 2277.725476][T29950] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 2277.725506][T29949] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 2278.653091][T27855] Bluetooth: hci6: command tx timeout [ 2279.773232][T27855] Bluetooth: hci7: command tx timeout [ 2279.773527][T29950] Bluetooth: hci8: command tx timeout [ 2280.733357][T29950] Bluetooth: hci6: command tx timeout [ 2281.853416][T29950] Bluetooth: hci8: command tx timeout [ 2281.853622][T27855] Bluetooth: hci7: command tx timeout [ 2282.816902][T27855] Bluetooth: hci6: command tx timeout [ 2282.819203][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 2282.828987][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 2283.933394][T27855] Bluetooth: hci7: command tx timeout [ 2283.933501][T29950] Bluetooth: hci8: command tx timeout [ 2284.893073][T29950] Bluetooth: hci6: command tx timeout [ 2286.014088][T29950] Bluetooth: hci8: command tx timeout [ 2286.019531][T29950] Bluetooth: hci7: command tx timeout [ 2290.013036][T29950] Bluetooth: hci4: command 0x0405 tx timeout [ 2316.040649][T29950] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 2316.051708][T29950] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 2316.061755][T29950] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 2316.074046][T29950] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 2316.085801][T29950] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 2318.173328][T27855] Bluetooth: hci9: command tx timeout [ 2320.253366][T27855] Bluetooth: hci9: command tx timeout [ 2322.333309][T27855] Bluetooth: hci9: command tx timeout [ 2324.413447][T27855] Bluetooth: hci9: command tx timeout [ 2329.091835][T29950] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 2329.106871][T29950] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 2329.115429][T29950] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 2329.127074][T29950] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 2329.135843][T29950] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 2331.214074][T27855] Bluetooth: hci10: command tx timeout [ 2333.293111][T27855] Bluetooth: hci10: command tx timeout [ 2335.373115][T27855] Bluetooth: hci10: command tx timeout [ 2337.106011][T29950] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 2337.118426][T29950] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 2337.129232][T29950] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 2337.139007][T29950] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 2337.147959][T29950] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 2337.453090][T27855] Bluetooth: hci10: command tx timeout [ 2338.198462][T29950] Bluetooth: hci12: unexpected cc 0x0c03 length: 249 > 1 [ 2338.208366][T29950] Bluetooth: hci12: unexpected cc 0x1003 length: 249 > 9 [ 2338.220702][T29950] Bluetooth: hci12: unexpected cc 0x1001 length: 249 > 9 [ 2338.231014][T29950] Bluetooth: hci12: unexpected cc 0x0c23 length: 249 > 4 [ 2338.245381][T29950] Bluetooth: hci12: unexpected cc 0x0c38 length: 249 > 2 [ 2338.288346][T29950] Bluetooth: hci13: unexpected cc 0x0c03 length: 249 > 1 [ 2338.299966][T29950] Bluetooth: hci13: unexpected cc 0x1003 length: 249 > 9 [ 2338.310814][T29950] Bluetooth: hci13: unexpected cc 0x1001 length: 249 > 9 [ 2338.318967][T29950] Bluetooth: hci13: unexpected cc 0x0c23 length: 249 > 4 [ 2338.326761][T29950] Bluetooth: hci13: unexpected cc 0x0c38 length: 249 > 2 [ 2339.213397][T29950] Bluetooth: hci11: command tx timeout [ 2340.334956][T29950] Bluetooth: hci12: command tx timeout [ 2340.413122][T29950] Bluetooth: hci13: command tx timeout [ 2341.293093][T29950] Bluetooth: hci11: command tx timeout [ 2342.413015][T29950] Bluetooth: hci12: command tx timeout [ 2342.493102][T29950] Bluetooth: hci13: command tx timeout [ 2343.373120][T29950] Bluetooth: hci11: command tx timeout [ 2344.258943][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 2344.265659][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 2344.493125][T29950] Bluetooth: hci12: command tx timeout [ 2344.573027][T29950] Bluetooth: hci13: command tx timeout [ 2345.453335][T29950] Bluetooth: hci11: command tx timeout [ 2346.573020][T29950] Bluetooth: hci12: command tx timeout [ 2346.653099][T29950] Bluetooth: hci13: command tx timeout [ 2376.644166][T27855] Bluetooth: hci14: unexpected cc 0x0c03 length: 249 > 1 [ 2376.656350][T27855] Bluetooth: hci14: unexpected cc 0x1003 length: 249 > 9 [ 2376.665157][T27855] Bluetooth: hci14: unexpected cc 0x1001 length: 249 > 9 [ 2376.677309][T27855] Bluetooth: hci14: unexpected cc 0x0c23 length: 249 > 4 [ 2376.686364][T27855] Bluetooth: hci14: unexpected cc 0x0c38 length: 249 > 2 [ 2378.733068][T27855] Bluetooth: hci14: command tx timeout [ 2380.813368][T27855] Bluetooth: hci14: command tx timeout [ 2382.173175][T27855] Bluetooth: hci0: command 0x0406 tx timeout [ 2382.893030][T29950] Bluetooth: hci14: command tx timeout [ 2384.973248][T29950] Bluetooth: hci14: command tx timeout [ 2389.158818][T27855] Bluetooth: hci15: unexpected cc 0x0c03 length: 249 > 1 [ 2389.167935][T27855] Bluetooth: hci15: unexpected cc 0x1003 length: 249 > 9 [ 2389.177109][T27855] Bluetooth: hci15: unexpected cc 0x1001 length: 249 > 9 [ 2389.188408][T27855] Bluetooth: hci15: unexpected cc 0x0c23 length: 249 > 4 [ 2389.198500][T27855] Bluetooth: hci15: unexpected cc 0x0c38 length: 249 > 2 [ 2391.213425][T29950] Bluetooth: hci15: command tx timeout [ 2392.413730][T29950] Bluetooth: hci3: command 0x0406 tx timeout [ 2393.293178][T27855] Bluetooth: hci15: command tx timeout [ 2393.533644][ T31] INFO: task kworker/0:3:5809 blocked for more than 143 seconds. [ 2393.542105][ T31] Not tainted 6.15.0-rc3-syzkaller-00094-g02ddfb981de8 #0 [ 2393.550835][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2393.559960][ T31] task:kworker/0:3 state:D stack:21592 pid:5809 tgid:5809 ppid:2 task_flags:0x4208060 flags:0x00004000 [ 2393.572189][ T31] Workqueue: usb_hub_wq hub_event [ 2393.577484][ T31] Call Trace: [ 2393.580776][ T31] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 2393.583795][ T31] __schedule+0x116f/0x5de0 [ 2393.588484][ T31] ? number+0x9aa/0xc70 [ 2393.593200][ T30] audit: type=1400 audit(1745636229.162:2716): avc: denied { write } for pid=5797 comm="syz-executor" path="pipe:[3710]" dev="pipefs" ino=3710 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 2393.616610][ T31] ? __pfx___schedule+0x10/0x10 [ 2393.621482][ T31] ? find_held_lock+0x2b/0x80 [ 2393.626288][ T31] ? schedule+0x2d7/0x3a0 [ 2393.630632][ T31] schedule+0xe7/0x3a0 [ 2393.636666][ T31] schedule_timeout+0x257/0x290 [ 2393.642109][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 2393.648845][ T31] ? mark_held_locks+0x49/0x80 [ 2393.656092][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 2393.661786][ T31] __wait_for_common+0x2fc/0x4e0 [ 2393.673623][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 2393.679529][ T31] ? __pfx___wait_for_common+0x10/0x10 [ 2393.691701][ T31] ? devtmpfs_submit_req+0x94/0x100 [ 2393.698879][ T31] devtmpfs_submit_req+0xa8/0x100 [ 2393.712602][ T31] devtmpfs_create_node+0x18a/0x230 [ 2393.717980][ T31] ? __pfx_devtmpfs_create_node+0x10/0x10 [ 2393.723786][ T31] ? up_write+0x1b2/0x520 [ 2393.728131][ T31] ? kernfs_create_link+0x1bd/0x240 [ 2393.733607][ T31] ? kernfs_put+0x35/0x60 [ 2393.737937][ T31] ? sysfs_do_create_link_sd+0xbb/0x140 [ 2393.743544][ T31] device_add+0x10bd/0x1a70 [ 2393.748316][ T31] ? __pfx_device_add+0x10/0x10 [ 2393.753236][ T31] usb_new_device+0xd07/0x1a20 [ 2393.758008][ T31] ? do_raw_spin_lock+0x12c/0x2b0 [ 2393.763078][ T31] ? __pfx_usb_new_device+0x10/0x10 [ 2393.768272][ T31] ? mark_held_locks+0x49/0x80 [ 2393.773344][ T31] hub_event+0x2eb7/0x4fa0 [ 2393.777785][ T31] ? __pfx_hub_event+0x10/0x10 [ 2393.782718][ T31] ? debug_object_deactivate+0x1ec/0x3a0 [ 2393.788431][ T31] ? rcu_is_watching+0x12/0xc0 [ 2393.793243][ T31] process_one_work+0x9cc/0x1b70 [ 2393.798187][ T31] ? __pfx_hcd_resume_work+0x10/0x10 [ 2393.803559][ T31] ? __pfx_process_one_work+0x10/0x10 [ 2393.808933][ T31] ? assign_work+0x1a0/0x250 [ 2393.813572][ T31] worker_thread+0x6c8/0xf10 [ 2393.818167][ T31] ? __kthread_parkme+0x19e/0x250 [ 2393.823220][ T31] ? __pfx_worker_thread+0x10/0x10 [ 2393.828333][ T31] kthread+0x3c2/0x780 [ 2393.832394][ T31] ? __pfx_kthread+0x10/0x10 [ 2393.837028][ T31] ? __pfx_kthread+0x10/0x10 [ 2393.841700][ T31] ? __pfx_kthread+0x10/0x10 [ 2393.846485][ T31] ? __pfx_kthread+0x10/0x10 [ 2393.851307][ T31] ? rcu_is_watching+0x12/0xc0 [ 2393.856128][ T31] ? __pfx_kthread+0x10/0x10 [ 2393.860720][ T31] ret_from_fork+0x45/0x80 [ 2393.865186][ T31] ? __pfx_kthread+0x10/0x10 [ 2393.869774][ T31] ret_from_fork_asm+0x1a/0x30 [ 2393.874583][ T31] [ 2393.877655][ T31] INFO: task kworker/0:6:29442 blocked for more than 143 seconds. [ 2393.885586][ T31] Not tainted 6.15.0-rc3-syzkaller-00094-g02ddfb981de8 #0 [ 2393.893234][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2393.901899][ T31] task:kworker/0:6 state:D stack:27752 pid:29442 tgid:29442 ppid:2 task_flags:0x4288060 flags:0x00004000 [ 2393.913971][ T31] Workqueue: md_misc mddev_delayed_delete [ 2393.919698][ T31] Call Trace: [ 2393.923014][ T31] [ 2393.925949][ T31] __schedule+0x116f/0x5de0 [ 2393.930453][ T31] ? __pfx___schedule+0x10/0x10 [ 2393.935885][ T31] ? __pfx___schedule+0x10/0x10 [ 2393.940742][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 2393.946156][ T31] ? find_held_lock+0x2b/0x80 [ 2393.951068][ T31] ? schedule+0x2d7/0x3a0 [ 2393.955647][ T31] schedule+0xe7/0x3a0 [ 2393.959715][ T31] schedule_timeout+0x257/0x290 [ 2393.964623][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 2393.970024][ T31] ? mark_held_locks+0x49/0x80 [ 2393.974856][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 2393.980058][ T31] __wait_for_common+0x2fc/0x4e0 [ 2393.985067][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 2393.990464][ T31] ? __pfx___wait_for_common+0x10/0x10 [ 2393.996050][ T31] ? devtmpfs_submit_req+0x94/0x100 [ 2394.001301][ T31] devtmpfs_submit_req+0xa8/0x100 [ 2394.006396][ T31] devtmpfs_delete_node+0xf6/0x160 [ 2394.011510][ T31] ? __pfx_devtmpfs_delete_node+0x10/0x10 [ 2394.017308][ T31] ? __call_rcu_common.constprop.0+0x3e5/0x9f0 [ 2394.023517][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 2394.028741][ T31] ? kernfs_put+0x4e/0x60 [ 2394.033148][ T31] ? sysfs_remove_group+0xc6/0x180 [ 2394.038261][ T31] device_del+0x734/0x9f0 [ 2394.042683][ T31] ? __pfx_device_del+0x10/0x10 [ 2394.047597][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 2394.053084][ T31] ? _raw_spin_unlock_irq+0x2e/0x50 [ 2394.058292][ T31] del_gendisk+0x486/0xc40 [ 2394.062805][ T31] ? __pfx_del_gendisk+0x10/0x10 [ 2394.067918][ T31] ? kernfs_put.part.0+0x18b/0x630 [ 2394.073075][ T31] md_kobj_release+0xb2/0x100 [ 2394.077760][ T31] kobject_put+0x1e4/0x5a0 [ 2394.082181][ T31] process_one_work+0x9cc/0x1b70 [ 2394.087172][ T31] ? __pfx_process_one_work+0x10/0x10 [ 2394.092569][ T31] ? assign_work+0x1a0/0x250 [ 2394.097617][ T31] worker_thread+0x6c8/0xf10 [ 2394.102252][ T31] ? __pfx_worker_thread+0x10/0x10 [ 2394.107430][ T31] kthread+0x3c2/0x780 [ 2394.111504][ T31] ? __pfx_kthread+0x10/0x10 [ 2394.116144][ T31] ? __pfx_kthread+0x10/0x10 [ 2394.120737][ T31] ? __pfx_kthread+0x10/0x10 [ 2394.125349][ T31] ? __pfx_kthread+0x10/0x10 [ 2394.129936][ T31] ? rcu_is_watching+0x12/0xc0 [ 2394.134741][ T31] ? __pfx_kthread+0x10/0x10 [ 2394.139326][ T31] ret_from_fork+0x45/0x80 [ 2394.143775][ T31] ? __pfx_kthread+0x10/0x10 [ 2394.148358][ T31] ret_from_fork_asm+0x1a/0x30 [ 2394.153172][ T31] [ 2394.156454][ T31] [ 2394.156454][ T31] Showing all locks held in the system: [ 2394.164263][ T31] 3 locks held by kworker/0:1/10: [ 2394.169279][ T31] #0: ffff8880226d9d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 2394.180852][ T31] #1: ffffc900000f7d18 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 2394.192164][ T31] #2: ffff8881453a0198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4fa0 [ 2394.201133][ T31] 2 locks held by kdevtmpfs/26: [ 2394.206023][ T31] #0: ffff88801c6d8950 (&type->i_mutex_dir_key/1){+.+.}-{4:4}, at: __kern_path_locked+0x132/0x2a0 [ 2394.216807][ T31] #1: ffffffff8eef55e8 (major_names_lock){+.+.}-{4:4}, at: blk_probe_dev+0x25/0x1a0 [ 2394.226431][ T31] 1 lock held by khungtaskd/31: [ 2394.231271][ T31] #0: ffffffff8e3bf5c0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 [ 2394.241175][ T31] 4 locks held by kworker/u8:4/80: [ 2394.246302][ T31] #0: ffff88801c2f3948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 2394.256838][ T31] #1: ffffc9000219fd18 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 2394.267131][ T31] #2: ffffffff9010d050 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xc9/0xb30 [ 2394.276516][ T31] #3: ffffffff90122ee8 (rtnl_mutex){+.+.}-{4:4}, at: tipc_net_stop+0xd5/0x130 [ 2394.285819][ T31] 2 locks held by getty/5569: [ 2394.290492][ T31] #0: ffff888035ac10a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 2394.300322][ T31] #1: ffffc9000333b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 [ 2394.310484][ T31] 3 locks held by kworker/0:3/5809: [ 2394.315724][ T31] #0: ffff8880226d9d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 2394.326555][ T31] #1: ffffc9000408fd18 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 2394.338050][ T31] #2: ffff888028fc0198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4fa0 [ 2394.347021][ T31] 3 locks held by kworker/u8:10/5940: [ 2394.352393][ T31] #0: ffff8880314a7948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 2394.363749][ T31] #1: ffffc9000b277d18 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 2394.376856][ T31] #2: ffffffff90122ee8 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x12/0x30 [ 2394.386418][ T31] 3 locks held by kworker/u8:11/10965: [ 2394.391864][ T31] #0: ffff88801b481148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 2394.403195][ T31] #1: ffffc9000394fd18 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 2394.417136][ T31] #2: ffffffff90122ee8 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0x51/0xc0 [ 2394.426249][ T31] 3 locks held by kworker/0:5/17622: [ 2394.431523][ T31] #0: ffff8880226d9d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 2394.442357][ T31] #1: ffffc90003e87d18 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 2394.453639][ T31] #2: ffff888145388198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4fa0 [ 2394.462943][ T31] 3 locks held by kworker/0:4/26477: [ 2394.468227][ T31] #0: ffff8880226d9d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 2394.479124][ T31] #1: ffffc9000f0c7d18 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 2394.490465][ T31] #2: ffff888145338198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4fa0 [ 2394.499636][ T31] 3 locks held by kworker/1:12/29438: [ 2394.505059][ T31] #0: ffff8880226d9d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 2394.516048][ T31] #1: ffffc9000bbc7d18 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 2394.527316][ T31] #2: ffff888029098198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4fa0 [ 2394.536266][ T31] 2 locks held by kworker/0:6/29442: [ 2394.541542][ T31] #0: ffff8880226da948 ((wq_completion)md_misc){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 2394.552131][ T31] #1: ffffc9000bbefd18 ((work_completion)(&mddev->del_work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 2394.563767][ T31] 2 locks held by syz.2.6075/29867: [ 2394.569200][ T31] #0: ffff88814128e420 (sb_writers){.+.+}-{0:0}, at: path_openat+0x1f3e/0x2d40 [ 2394.578319][ T31] #1: ffff88801c6d8950 (&type->i_mutex_dir_key#2){++++}-{4:4}, at: path_openat+0x88a/0x2d40 [ 2394.588584][ T31] 2 locks held by syz-executor/29887: [ 2394.593964][ T31] #0: ffffffff90852440 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x113/0x2c0 [ 2394.603593][ T31] #1: ffffffff90122ee8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x600/0x2000 [ 2394.612704][ T31] 1 lock held by syz.0.6092/29927: [ 2394.617852][ T31] #0: ffffffff90122ee8 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x371/0xe90 [ 2394.627441][ T31] 1 lock held by syz.1.6093/29933: [ 2394.632542][ T31] #0: ffffffff90122ee8 (rtnl_mutex){+.+.}-{4:4}, at: do_ip_setsockopt+0xf6/0x3240 [ 2394.641886][ T31] 1 lock held by syz.4.6094/29936: [ 2394.647051][ T31] #0: ffffffff90122ee8 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x371/0xe90 [ 2394.656757][ T31] 1 lock held by syz-executor/29938: [ 2394.662037][ T31] #0: ffffffff90122ee8 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x30c/0x1540 [ 2394.671753][ T31] 1 lock held by syz-executor/29941: [ 2394.677069][ T31] #0: ffffffff90122ee8 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x30c/0x1540 [ 2394.686562][ T31] 1 lock held by syz-executor/29945: [ 2394.691854][ T31] #0: ffffffff90122ee8 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x30c/0x1540 [ 2394.701423][ T31] 1 lock held by syz-executor/29946: [ 2394.706773][ T31] #0: ffffffff90122ee8 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x30c/0x1540 [ 2394.716392][ T31] 1 lock held by syz-executor/29956: [ 2394.722005][ T31] #0: ffffffff90122ee8 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x30c/0x1540 [ 2394.731482][ T31] 1 lock held by syz-executor/29959: [ 2394.737097][ T31] #0: ffffffff90122ee8 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x30c/0x1540 [ 2394.746576][ T31] 1 lock held by syz-executor/29962: [ 2394.751850][ T31] #0: ffffffff90122ee8 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x30c/0x1540 [ 2394.761360][ T31] 1 lock held by syz-executor/29966: [ 2394.766693][ T31] #0: ffffffff90122ee8 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x30c/0x1540 [ 2394.776403][ T31] 1 lock held by syz-executor/29968: [ 2394.781687][ T31] #0: ffffffff90122ee8 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x30c/0x1540 [ 2394.791161][ T31] 1 lock held by syz-executor/29971: [ 2394.796467][ T31] #0: ffffffff90122ee8 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x30c/0x1540 [ 2394.805945][ T31] 1 lock held by syz-executor/29974: [ 2394.811230][ T31] #0: ffffffff90122ee8 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x30c/0x1540 [ 2394.820800][ T31] [ 2394.824297][ T31] ============================================= [ 2394.824297][ T31] [ 2394.834429][ T31] NMI backtrace for cpu 1 [ 2394.834445][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-rc3-syzkaller-00094-g02ddfb981de8 #0 PREEMPT(full) [ 2394.834466][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 2394.834476][ T31] Call Trace: [ 2394.834482][ T31] [ 2394.834490][ T31] dump_stack_lvl+0x116/0x1f0 [ 2394.834513][ T31] nmi_cpu_backtrace+0x27b/0x390 [ 2394.834539][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 2394.834556][ T31] nmi_trigger_cpumask_backtrace+0x29c/0x300 [ 2394.834583][ T31] watchdog+0xf70/0x12c0 [ 2394.834603][ T31] ? __pfx_watchdog+0x10/0x10 [ 2394.834617][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 2394.834636][ T31] ? __kthread_parkme+0x19e/0x250 [ 2394.834660][ T31] ? __pfx_watchdog+0x10/0x10 [ 2394.834674][ T31] kthread+0x3c2/0x780 [ 2394.834691][ T31] ? __pfx_kthread+0x10/0x10 [ 2394.834704][ T31] ? __pfx_kthread+0x10/0x10 [ 2394.834719][ T31] ? __pfx_kthread+0x10/0x10 [ 2394.834732][ T31] ? __pfx_kthread+0x10/0x10 [ 2394.834746][ T31] ? rcu_is_watching+0x12/0xc0 [ 2394.834765][ T31] ? __pfx_kthread+0x10/0x10 [ 2394.834781][ T31] ret_from_fork+0x45/0x80 [ 2394.834797][ T31] ? __pfx_kthread+0x10/0x10 [ 2394.834812][ T31] ret_from_fork_asm+0x1a/0x30 [ 2394.834846][ T31] [ 2394.834897][ T31] Sending NMI from CPU 1 to CPUs 0: [ 2394.975744][ C0] NMI backtrace for cpu 0 [ 2394.975759][ C0] CPU: 0 UID: 0 PID: 57 Comm: kworker/u8:3 Not tainted 6.15.0-rc3-syzkaller-00094-g02ddfb981de8 #0 PREEMPT(full) [ 2394.975777][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 2394.975786][ C0] Workqueue: events_unbound cfg80211_wiphy_work [ 2394.975807][ C0] RIP: 0010:rcu_is_watching+0x73/0xc0 [ 2394.975825][ C0] Code: ce 8d 48 b8 00 00 00 00 00 fc ff df 48 89 da 48 c1 ea 03 0f b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 24 8b 03 e8 02 83 e0 01 65 ff 0d 50 d6 02 12 74 07 5b 5d c3 cc cc cc cc [ 2394.975838][ C0] RSP: 0018:ffffc9000123f5a8 EFLAGS: 00000246 [ 2394.975849][ C0] RAX: 000000000ee7454c RBX: ffff8880b8432de8 RCX: 0000000000000002 [ 2394.975857][ C0] RDX: 0000000000000000 RSI: ffffffff8bf476a0 RDI: ffffffff8dcead00 [ 2394.975865][ C0] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2394.975874][ C0] R10: 0000000000000003 R11: 00000000000069ef R12: 0000000000000000 [ 2394.975883][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2394.975891][ C0] FS: 0000000000000000(0000) GS:ffff8881249e5000(0000) knlGS:0000000000000000 [ 2394.975905][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2394.975914][ C0] CR2: 00007fff580adff8 CR3: 000000000e180000 CR4: 00000000003526f0 [ 2394.975931][ C0] Call Trace: [ 2394.975936][ C0] [ 2394.975943][ C0] lock_acquire+0x2cd/0x350 [ 2394.975962][ C0] ? unwind_next_frame+0x3f4/0x20a0 [ 2394.975980][ C0] unwind_next_frame+0xd1/0x20a0 [ 2394.975994][ C0] ? unwind_next_frame+0xbd/0x20a0 [ 2394.976008][ C0] ? arch_stack_walk+0x73/0x100 [ 2394.976027][ C0] __unwind_start+0x45f/0x7f0 [ 2394.976042][ C0] ? kasan_save_stack+0x33/0x60 [ 2394.976060][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 2394.976078][ C0] arch_stack_walk+0x73/0x100 [ 2394.976094][ C0] ? arch_stack_walk+0x73/0x100 [ 2394.976112][ C0] stack_trace_save+0x8e/0xc0 [ 2394.976127][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 2394.976143][ C0] ? __lock_acquire+0xaa4/0x1ba0 [ 2394.976161][ C0] kasan_save_stack+0x33/0x60 [ 2394.976194][ C0] kasan_save_track+0x14/0x30 [ 2394.976213][ C0] kasan_save_free_info+0x3b/0x60 [ 2394.976228][ C0] __kasan_slab_free+0x51/0x70 [ 2394.976241][ C0] kmem_cache_free+0x2d4/0x4d0 [ 2394.976259][ C0] ? trace_drop_common.constprop.0+0x27a/0x510 [ 2394.976277][ C0] ? skb_free_head+0x18a/0x1d0 [ 2394.976294][ C0] skb_free_head+0x18a/0x1d0 [ 2394.976311][ C0] skb_release_data+0x7a5/0x960 [ 2394.976328][ C0] ? rcu_is_watching+0x12/0xc0 [ 2394.976344][ C0] sk_skb_reason_drop+0x129/0x1a0 [ 2394.976364][ C0] ieee80211_iface_work+0x434/0x1020 [ 2394.976386][ C0] ? rcu_is_watching+0x12/0xc0 [ 2394.976402][ C0] cfg80211_wiphy_work+0x3dc/0x550 [ 2394.976418][ C0] process_one_work+0x9cc/0x1b70 [ 2394.976436][ C0] ? __pfx_bond_netdev_notify_work+0x10/0x10 [ 2394.976455][ C0] ? __pfx_process_one_work+0x10/0x10 [ 2394.976472][ C0] ? assign_work+0x1a0/0x250 [ 2394.976486][ C0] worker_thread+0x6c8/0xf10 [ 2394.976503][ C0] ? __pfx_worker_thread+0x10/0x10 [ 2394.976516][ C0] kthread+0x3c2/0x780 [ 2394.976529][ C0] ? __pfx_kthread+0x10/0x10 [ 2394.976541][ C0] ? __pfx_kthread+0x10/0x10 [ 2394.976551][ C0] ? __pfx_kthread+0x10/0x10 [ 2394.976562][ C0] ? __pfx_kthread+0x10/0x10 [ 2394.976573][ C0] ? rcu_is_watching+0x12/0xc0 [ 2394.976587][ C0] ? __pfx_kthread+0x10/0x10 [ 2394.976600][ C0] ret_from_fork+0x45/0x80 [ 2394.976611][ C0] ? __pfx_kthread+0x10/0x10 [ 2394.976622][ C0] ret_from_fork_asm+0x1a/0x30 [ 2394.976645][ C0] [ 2394.976942][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 2395.328232][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-rc3-syzkaller-00094-g02ddfb981de8 #0 PREEMPT(full) [ 2395.340018][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 2395.350053][ T31] Call Trace: [ 2395.353330][ T31] [ 2395.356243][ T31] dump_stack_lvl+0x3d/0x1f0 [ 2395.360823][ T31] panic+0x71c/0x800 [ 2395.364714][ T31] ? __pfx_panic+0x10/0x10 [ 2395.369116][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 2395.374475][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 2395.380437][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 2395.385789][ T31] ? watchdog+0xdda/0x12c0 [ 2395.390189][ T31] ? watchdog+0xdcd/0x12c0 [ 2395.394588][ T31] watchdog+0xdeb/0x12c0 [ 2395.398821][ T31] ? __pfx_watchdog+0x10/0x10 [ 2395.403482][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 2395.408666][ T31] ? __kthread_parkme+0x19e/0x250 [ 2395.413688][ T31] ? __pfx_watchdog+0x10/0x10 [ 2395.418344][ T31] kthread+0x3c2/0x780 [ 2395.422396][ T31] ? __pfx_kthread+0x10/0x10 [ 2395.426966][ T31] ? __pfx_kthread+0x10/0x10 [ 2395.431536][ T31] ? __pfx_kthread+0x10/0x10 [ 2395.436149][ T31] ? __pfx_kthread+0x10/0x10 [ 2395.440740][ T31] ? rcu_is_watching+0x12/0xc0 [ 2395.445499][ T31] ? __pfx_kthread+0x10/0x10 [ 2395.450076][ T31] ret_from_fork+0x45/0x80 [ 2395.454484][ T31] ? __pfx_kthread+0x10/0x10 [ 2395.459061][ T31] ret_from_fork_asm+0x1a/0x30 [ 2395.463828][ T31] [ 2395.467072][ T31] Kernel Offset: disabled [ 2395.471413][ T31] Rebooting in 86400 seconds..